fix: move LLM config to encrypted ConfigMap (CI-friendly)

Problem: LLM_API_URL was hardcoded to external endpoint
- Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin)
- Not externalizable for CI/different environments

Solution: Move to encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS, no nginx hairpin, direct cluster communication
- Encrypted with SOPS for security
- CI can update values.yaml and auto-deploy

Changes:
- Create configmap.enc.yaml (SOPS-encrypted)
- Update deployment.yaml to use configMapKeyRef
- Add SOPS config to kustomization.yaml
- Deployment now references portfolio-llm-config ConfigMap

infra/portfolio/base/configmap.enc.yaml

@@ -0,0 +1,27 @@
+apiVersion: ENC[AES256_GCM,data:Qv8=,iv:v6kMpvgzkpGdOzuwurpWhVJG8dqjHG55mZebDs0PeWs=,tag:9W00OTNe1kQ9mA/l0eSINg==,type:str]
+kind: ENC[AES256_GCM,data:TUqF1gRXmGmc,iv:ettHZPLG+Jw29TuSmeUNi4DsK944JNgvmu6hry3osSo=,tag:CbtvTOVxpWivW6UyO7MrLA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:0YEEc2oqKeGjWr7C0eAzz0dZft0=,iv:BnCIMRZAsDdW3IxIAhsj/WrZNCipG5qT1kfnuQykt20=,tag:EFjanh4e6T5bQX6dupXRgw==,type:str]
+    namespace: ENC[AES256_GCM,data:MheF93lBY58x,iv:Mp64W8Beu+q8NiQTtUhpAxwcfT4JPkLenjh7ljJaGak=,tag:ves1LGuzj1QGY1OpqF560g==,type:str]
+    labels:
+        app.kubernetes.io/name: ENC[AES256_GCM,data:i+aoOfomVrFm,iv:/g+F6ZaWDvzjjv4P35rgcBMSSAyrTyWymm//KVRrpYg=,tag:UIn8tKERKolTYq/bVdQ+iA==,type:str]
+data:
+    #ENC[AES256_GCM,data:9whKTa+VQQtYnOrrTanXJpPZltIEiAh029xIu9YhAqcaXQ2I6XTmCU8LqyNrQKNw5CWJJg0F,iv:Sm5T9g2aJQz0qrNzA1B8QBGRkio6u5AAc+hWoUIs0bU=,tag:jxZ0llX6pKYBsvtRxCdgaA==,type:comment]
+    #ENC[AES256_GCM,data:XLVVNIgolPDi5pkm/S6IZJHZIj+84b/1VTwLCnrePwFmDrIfRdJAG7LbxWFmRJtaO2TEHnd2FEHIEg==,iv:YkfB3Q26+PHqd+51gAZOXoJKPpvIeT5wN0Ye10spdYM=,tag:spTTVuE52SvDuTo3LQXqOw==,type:comment]
+    LLM_API_URL: ENC[AES256_GCM,data:dJRd+J1ovECOIctWhwMYuhv3rReqmwUHkcN8fxtxLfohIqg8/LOsPw5FE2B9GrEzjnYwTcku6vyvb+CCCJMLmDE=,iv:23Jo8dgWeMLX+uYyFQXPa1cHqKVTPs6qHI4i/Go6lTY=,tag:KuRtrTdzKk3uf9ph5Qp5Nw==,type:str]
+    LLM_MODEL: ENC[AES256_GCM,data:lRDaz2Fey+2czl3K1Qju/82XNw==,iv:nJR+wNNGKDCkYdToEfERqYZdVS34TmVvMVRjLHYFgE8=,tag:XOiZmi9k+54yJm4ofUiXFw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWEpWNFQ4TXNlSG5NcVFB
+            Tll2OUFFUjV4RDAvOE5ZSWRZZE5YL2xGYkY4CjI4SFp5OXJlcHd0WG9vTVFwM2do
+            YVVleVhCam9qeGVhL05xMG5mMWorNWMKLS0tIHU4MVNuSjkwNkNKTi93OXFkQlJh
+            Y28wbW9uK21zYzNWUzE2MzJKN0t2cFUKlgVpvion4Qg7DFw/arUZupyy1d7I59P4
+            njaeu0pTj6StNiZfHhCguVWpYBECnSaF5A4aoLFbUFVpdL/JC8V2GQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-07T06:23:56Z"
+    mac: ENC[AES256_GCM,data:2ufxupBbFbV08JJoN3ySbehsCqmAfNt6anUeaWg4JlxvTN+51yd8NeW76HJ8yo0MSf7FjjnX83CHeuVmcJaIXcTTFjKW4Dp3Ww5LYq9PESQu6ywoeXSfsrYH+T1WKAUCJq/HJOYHTvnpS4zSnHfDA8madHWjJI3/Hl1haC0cKyE=,iv:/Xv//b2mBrr+Rye01YNjvdUp4zLi/+Ly+4RCqG2RO+s=,tag:g+7rr4dxXbkATSBVQ4l0Wg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2