fix: move LLM config to encrypted ConfigMap (CI-friendly)

Problem: LLM_API_URL was hardcoded to external endpoint
- Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin)
- Not externalizable for CI/different environments

Solution: Move to encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS, no nginx hairpin, direct cluster communication
- Encrypted with SOPS for security
- CI can update values.yaml and auto-deploy

Changes:
- Create configmap.enc.yaml (SOPS-encrypted)
- Update deployment.yaml to use configMapKeyRef
- Add SOPS config to kustomization.yaml
- Deployment now references portfolio-llm-config ConfigMap

infra/portfolio/base/kustomization.yaml

@@ -3,6 +3,11 @@ kind: Kustomization
 namespace: portfolio
 resources:
 - namespace.yaml
+- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
+
+# Decrypt secrets via SOPS before applying
+sops:
+  version: 3