fix(network): allow poimen namespace to access api-gateway

Enable Poimen orchestrator and worker pods to reach the LLM API gateway
in the api namespace.

The api-gateway NetworkPolicy was only allowing traffic from:
- ingress-nginx (external ingress)
- monitoring (Prometheus scraping)

Added new ingress rule to allow:
- poimen namespace (orchestrator-job and worker pods)
- Port 8080 (api-gateway service port)

This fixes the DNS resolution error where orchestrator pods couldn't
reach http://api-gateway.api:8080/health from within the cluster.

Managed via ArgoCD in homelab/k8s/argocd/apps/55-api-gateway.yaml
which syncs from this repo's k8s/ directory.

k8s/network-policy.yaml

@@ -29,6 +29,15 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
+  # Allow from poimen namespace (orchestrator & worker pods)
+  # Enable Poimen workflows to call the LLM API gateway
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: poimen
+    ports:
+    - protocol: TCP
+      port: 8080
   egress:
   # Allow DNS
   - to: