fix(api): label Kong pods llm-client=true so llm-serving NetworkPolicy admits them — chat/embeddings/rerank/score routes silently hung until the client timeout because Cilium dropped Kong's packets

llm-serving-default-deny admits port 8080 only from pods carrying
llm-client=true. Kong lacked it, so every route that actually contacts an
upstream timed out. /v1/models masked the problem: request-termination answers
inside Kong and never touches an upstream, so it returned 200 throughout.

Opting in via podLabels rather than relaxing the policy — it is a compensating
control, not hygiene, since vLLM v0.11.0 is frozen on Volta and will not receive
patches for several remote/unauthenticated advisories.

podLabels land only in the pod template, not spec.selector.matchLabels, so this
is not an immutable-field change.

k8s/apps/api/kong-values.yaml

@@ -29,6 +29,18 @@ fullnameOverride: kong
 # stateless in DB-less mode, so replicas are pure redundancy.
 replicaCount: 2
 
+# Opt in to the `llm-serving-default-deny` NetworkPolicy, which admits port 8080
+# only from pods carrying this label. That policy is a compensating control, not
+# hygiene: vLLM v0.11.0 is frozen on Volta and will never receive patches for
+# several remote/unauthenticated advisories, so it must not be broadly reachable.
+#
+# Without this label Cilium DROPS the packets rather than refusing them, so the
+# symptom is a request that hangs until the client's timeout — not a connection
+# error. /v1/models still worked while this was missing, because
+# request-termination answers inside Kong and never touches an upstream.
+podLabels:
+  llm-client: "true"
+
 env:
   # DB-less. Config comes from Kubernetes objects via the ingress controller, so
   # git stays the source of truth. A Postgres-backed Kong would put live routing