feat: cut api.riotpiao.com over to the Go gateway and retire Kong

Ingress api/api now backs onto api-gateway:8080; the kong Application, its
Helm values, plugins and llm-routes are removed. Gateway image v0.0.0 is in
the Forgejo registry and the pull secret is in the api namespace.

k8s/apps/api/ingress.yaml

@@ -5,14 +5,17 @@
 #
 # nginx terminates TLS with the wildcard *.riotpiao.com cert (served as its
 # default-ssl-certificate, so no per-rule `tls:` block is needed) and forwards
-# plain HTTP to kong-proxy. Kong then does the real routing, from Ingresses
-# carrying `ingressClassName: kong`.
+# plain HTTP to the gateway.
 #
-# Catch-all `/` on purpose: everything under this host belongs to Kong. Listing
-# per-API paths here would duplicate Kong's routing table inside nginx, and the
-# two copies would drift.
+# Backend was kong-proxy:80 until Kong was retired on 2026-08-19; it is now the
+# Go gateway's Service, api-gateway:8080, deployed from rock/homelab-frontend.
+# Reverting the cutover is a change to these two lines and nothing else.
 #
-# In-cluster callers should prefer http://kong-proxy.api.svc.cluster.local
+# Catch-all `/` on purpose: everything under this host belongs to the gateway.
+# Listing per-API paths here would duplicate the gateway's routing table inside
+# nginx, and the two copies would drift.
+#
+# In-cluster callers should prefer http://api-gateway.api.svc.cluster.local:8080
 # directly. Resolving api.riotpiao.com sends them out to nginx and back in,
 # which is a pointless hairpin unless they need TLS or the public hostname.
 apiVersion: networking.k8s.io/v1
@@ -38,6 +41,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: kong-proxy
+                name: api-gateway
                 port:
-                  number: 80
+                  number: 8080