Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/gateway/certificate-skyliner.yaml

@@ -0,0 +1,17 @@
+# ------------------------------------------------------------------------------
+# Certificate for skyliner.wdw-labs.cloud (LiteLLM)
+# Single-host cert; referenced by listener "https-skyliner" in gateway.yaml.
+# Requires letsencrypt-prod dnsZones to include wdw-labs.cloud (cert-manager).
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: skyliner-wdw-labs-tls
+  namespace: gateway
+spec:
+  secretName: skyliner-wdw-labs-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - skyliner.wdw-labs.cloud