Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/applications/litellm/application.yaml

@@ -0,0 +1,84 @@
+# ============================================================================
+# ArgoCD Application: LiteLLM proxy (skyliner)
+# Wave: 8 (same tier as hindsight / openviking)
+# Deployment method: GitOps (Gitea -> ArgoCD)
+# ============================================================================
+#
+# Multi-source: upstream OCI Helm chart (pinned) + local values + manifests
+# from repo (namespace, ExternalSecrets, HTTPRoute, ExternalName Services,
+# ServiceMonitor). Follows the openviking / hindsight pattern.
+#
+# Chart: oci://ghcr.io/berriai/litellm-helm  (version == appVersion)
+# Includes bundled Bitnami PostgreSQL (db.deployStandalone: true).
+#
+# NOTE (ArgoCD + OCI): repoURL has NO "oci://" prefix. If the OCI registry is not
+# already usable by ArgoCD, register it once (public repo, no creds needed):
+#   argocd repo add ghcr.io/berriai --type helm --name berriai-oci --enable-oci
+#
+# Platform changes required BEFORE this syncs (see DEPLOYMENT GATE below).
+# ============================================================================
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: litellm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: litellm
+    app.kubernetes.io/part-of: mk-labs
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+    description: |
+      LiteLLM OpenAI-compatible gateway for Paperclip/OpenCode and Hermes agents.
+      Host: skyliner.wdw-labs.cloud (fastpass-gateway, HTTPRoute). Admin UI at /ui.
+      Backends: illuminations vLLM (Gemma-4-26B); Mac Studio (fantasmic) and
+      Mac Mini (wishes) as placeholders.
+spec:
+  project: default
+
+  sources:
+    # Source 1: upstream OCI Helm chart, pinned
+    - repoURL: ghcr.io/berriai
+      chart: litellm-helm
+      targetRevision: 1.106.1
+      helm:
+        releaseName: litellm
+        valueFiles:
+          - $values/cluster/applications/litellm/values.yaml
+
+    # Source 2: homelab repo — values ref + manifests
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/applications/litellm
+      ref: values
+      directory:
+        # Not Kubernetes manifests
+        exclude: "{application.yaml,values.yaml}"
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: litellm
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+
+# ============================================================================
+# DEPLOYMENT GATE: DO NOT MERGE/SYNC UNTIL
+# ============================================================================
+# 1. 1Password vault wdw-labs has item "litellm" (master-key, salt-key, db-password,
+#    db-admin-password) and items "illuminations", "fantasmic",
+#    "wishes" (field "api-key"); the onepassword-connect token can read
+#    wdw-labs and the ClusterSecretStore lists it (platform/onepassword-connect).
+#    (master-key must start with "sk-"; salt-key is PERMANENT — never rotate it
+#    after models/keys are stored, or stored credentials become undecryptable).
+# 2. Platform changes are live: cert-manager dnsZones (wdw-labs.cloud), gateway
+#    listener + skyliner Certificate, ReferenceGrant for litellm, and external-dns
+#    (Technitium) can write to the wdw-labs.cloud zone (zone exists + TSIG key
+#    authorized for it).
+# 3. DNS names fantasmic.wdw-labs.cloud / wishes.wdw-labs.cloud resolve from pods.
+# 4. Verified with `helm template` (see README / hand-off notes).
+# ============================================================================