Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/gateway/gateway.yaml

@@ -36,3 +36,18 @@ spec:
       allowedRoutes:
         namespaces:
           from: All
+    # Dedicated listener for LiteLLM (skyliner) — wdw-labs.cloud is not covered
+    # by the wildcard cert above. Cert: certificate-skyliner.yaml
+    - name: https-skyliner
+      port: 443
+      protocol: HTTPS
+      hostname: skyliner.wdw-labs.cloud
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: skyliner-wdw-labs-tls
+      allowedRoutes:
+        namespaces:
+          from: All