feat: cut api.riotpiao.com over to the Go gateway and retire Kong

Ingress api/api now backs onto api-gateway:8080; the kong Application, its
Helm values, plugins and llm-routes are removed. Gateway image v0.0.0 is in
the Forgejo registry and the pull secret is in the api namespace.

k8s/apps/api/kustomization.yaml

@@ -1,14 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-# Explicit allowlist so kong-values.yaml in this directory is NOT treated as a
-# manifest — it is Helm input consumed by the chart source of the `kong`
-# Application, not a Kubernetes object. Anything new added here must be listed
-# or it is silently dropped with no error and no drift shown.
+# Explicit allowlist. Anything added to this directory and not listed here is
+# silently dropped — no error, no drift shown.
+#
+# Down to a single Ingress since Kong was retired (2026-08-19). The Kong Helm
+# values, the KongClusterPlugin for Prometheus, the six KongPlugin CRs behind
+# the path-per-model LLM surface, the KongConsumer and the key-auth plan all
+# went with it.
 resources:
   - ingress.yaml
-  - kong-metrics.yaml
-  - llm-routes.yaml
-  - model-auth.yaml
 # No top-level `namespace:` transformer on purpose: ingress.yaml sets its own
 # namespace, and the transformer rewrites metadata.namespace on every resource
 # it builds, which is a trap for anything cross-namespace added later.