feat: cut api.riotpiao.com over to the Go gateway and retire Kong

Ingress api/api now backs onto api-gateway:8080; the kong Application, its
Helm values, plugins and llm-routes are removed. Gateway image v0.0.0 is in
the Forgejo registry and the pull secret is in the api namespace.

k8s/apps/agent-pod/console-ingress.yaml

@@ -1,14 +1,27 @@
 # Exposes agent-hub at api.riotpiao.com/console (WebSocket) and /run
 # (trigger a new session) -- both are routes on the same hub.js service.
+#
+# Was ingressClassName: kong until Kong was retired on 2026-08-19. Pointed
+# straight at nginx rather than through the replacement Go gateway because that
+# gateway has no WebSocket upgrade support yet -- routing /console through it
+# would break the console outright. nginx handles the upgrade natively.
+#
+# Path precedence: the nginx Ingress api/api catch-alls `/` on this same host
+# to the gateway. nginx matches longest prefix first, so these three paths win
+# over `/` and the rest of the host still reaches the gateway.
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: console
   namespace: agent-pod
   annotations:
-    konghq.com/strip-path: "false"
+    # A console WebSocket stays open across a whole agent session; nginx's 60s
+    # default read timeout would drop it mid-run.
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
 spec:
-  ingressClassName: kong
+  ingressClassName: nginx
   rules:
     - host: api.riotpiao.com
       http: