fix: label gateway pods llm-client=true so upstreams accept them

llm-serving-default-deny admits only llm-client=true pods on 8080; without the
label every dispatch timed out with 502.

k8s/deployment.yaml

@@ -21,6 +21,10 @@ spec:
       labels:
         app: api-gateway
         component: gateway
+        # Required by the llm-serving-default-deny NetworkPolicy, which admits
+        # only pods labelled llm-client=true (from any namespace) on port 8080.
+        # Without it every upstream dial times out and dispatch returns 502.
+        llm-client: "true"
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"