feat: cut api.riotpiao.com over to the Go gateway and retire Kong

Ingress api/api now backs onto api-gateway:8080; the kong Application, its
Helm values, plugins and llm-routes are removed. Gateway image v0.0.0 is in
the Forgejo registry and the pull secret is in the api namespace.

k8s/argocd/apps/55-api-gateway.yaml

@@ -1,39 +1,44 @@
-# Wave 7 — Kong, the cluster's internal API gateway (namespace `api`).
+# Wave 7 — api-gw, the cluster's API gateway (namespace `api`).
 #
-# Sits between nginx and the backend services: nginx owns the edge and TLS,
-# Kong owns routing policy, auth and rate limiting. Wave 7 puts it after the
-# data/messaging tiers it fronts and before the wave-8 applications that
-# publish routes into it.
+# Replaces Kong OSS 3.4.1, removed 2026-08-19. Kong existed to route
+# `api.riotpiao.com`, but Kong OSS cannot dispatch on a request body, so the
+# LLM surface had to be expressed as one path per model
+# (`/v1/reasoning/chat/completions`, `/v1/ornith/...`, `/v1/qwen/...`) with a
+# `request-transformer` plugin forcing the body's `model` field on each. The Go
+# gateway reads the body and picks the upstream, so a single canonical
+# `POST /v1/chat/completions` covers every model. See
+# docs/adr/ADR-0001-retire-kong-for-go-gateway.md in the frontend repo.
 #
-# DB-less: routing config comes from Kubernetes objects (Ingress with
-# `ingressClassName: kong`, plus KongPlugin/KongConsumer CRDs), so git remains
-# the source of truth and there are no migration Jobs on upgrade.
+# Two sources:
+#   1. rock/homelab-frontend on the in-cluster Forgejo — the gateway's own
+#      kustomization (Deployment, Service, ConfigMap, RBAC, NetworkPolicy). It
+#      sets `namespace: api` itself, so no transformer is needed here. The
+#      Forgejo host must stay listed in the `homelab` AppProject sourceRepos or
+#      this Application is rejected with "is not permitted in project".
+#   2. k8s/apps/api in this repo — the nginx edge Ingress for
+#      api.riotpiao.com, inherited from the retired `kong` Application. It
+#      cannot move to k8s/bootstrap/ingress/ingress.yaml because that syncs in
+#      wave 1, before namespace `api` exists.
 #
-# CRDs ship in the chart's crds/ directory; ArgoCD applies those by default
-# (helm.skipCrds is left false).
+# No resources-finalizer: deleting this Application leaves the workload running
+# rather than cascading the delete.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: kong
+  name: api-gw
   namespace: argocd
+  labels:
+    app.kubernetes.io/name: api-gateway
+    app.kubernetes.io/component: gateway
   annotations:
     argocd.argoproj.io/sync-wave: "7"
 spec:
   project: homelab
   revisionHistoryLimit: 3
   sources:
-    - repoURL: https://charts.konghq.com
-      chart: kong
-      targetRevision: "3.4.1"
-      helm:
-        valueFiles:
-          - $values/k8s/apps/api/kong-values.yaml
-    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab-frontend.git
       targetRevision: main
-      ref: values
-    # The nginx Ingress for api.riotpiao.com. Kept in this Application rather
-    # than the central k8s/bootstrap/ingress/ingress.yaml because that one syncs
-    # in wave 1, before namespace `api` exists.
+      path: k8s
     - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
       targetRevision: main
       path: k8s/apps/api
@@ -46,13 +51,9 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
-      # The chart's CRDs exceed the annotation size limit that client-side
-      # apply relies on; server-side apply avoids the
-      # "metadata.annotations: Too long" failure CRDs commonly hit.
-      - ServerSideApply=true
     retry:
-      limit: 3
+      limit: 5
       backoff:
-        duration: 10s
+        duration: 5s
         factor: 2
         maxDuration: 3m

k8s/argocd/apps/56-llm-serving.yaml

@@ -1,7 +1,7 @@
 # Wave 6 — the model servers behind api.riotpiao.com (namespace `llm-serving`).
 #
-# Syncs before wave 7 (Kong), so the predictor Services exist before the routes
-# that point at them. KServe itself is part of the substrate; this Application
+# Syncs before wave 7 (api-gw), so the predictor Services exist before the
+# gateway that routes to them. KServe itself is part of the substrate; this Application
 # owns only the InferenceServices.
 #
 # Adopted from live state on 2026-08-15. These five had been `kubectl apply`-ed