Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/cert-manager/clusterissuer.yaml

@@ -25,6 +25,7 @@ spec:
         selector:
           dnsZones:
             - mk-labs.cloud
+            - wdw-labs.cloud
 
 ---
 # Production issuer — switch to this once staging certs are working
@@ -47,3 +48,4 @@ spec:
         selector:
           dnsZones:
             - mk-labs.cloud
+            - wdw-labs.cloud