fix: move LLM config to encrypted ConfigMap (CI-friendly)

Problem: LLM_API_URL was hardcoded to external endpoint
- Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin)
- Not externalizable for CI/different environments

Solution: Move to encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS, no nginx hairpin, direct cluster communication
- Encrypted with SOPS for security
- CI can update values.yaml and auto-deploy

Changes:
- Create configmap.enc.yaml (SOPS-encrypted)
- Update deployment.yaml to use configMapKeyRef
- Add SOPS config to kustomization.yaml
- Deployment now references portfolio-llm-config ConfigMap

infra/portfolio/base/deployment.yaml

@@ -42,11 +42,17 @@ spec:
             secretKeyRef:
               name: portfolio-agent-oidc
               key: TOKEN_URL
-        # LLM API configuration
+        # LLM API configuration (from encrypted ConfigMap)
         - name: LLM_API_URL
-          value: "https://api.riotpiao.com/v1/chat/completions"
+          valueFrom:
+            configMapKeyRef:
+              name: portfolio-llm-config
+              key: LLM_API_URL
         - name: LLM_MODEL
-          value: "qwen2.5:3b-instruct"
+          valueFrom:
+            configMapKeyRef:
+              name: portfolio-llm-config
+              key: LLM_MODEL
         ports:
         - name: http
           containerPort: 3000