Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/gateway/referencegrant.yaml

@@ -16,6 +16,7 @@
 #   - monitoring    (Grafana)
 #   - authentik     (Authentik SSO — future)
 #   - gitea         (Gitea — future)
+#   - litellm       (LiteLLM / skyliner)
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: ReferenceGrant
@@ -45,6 +46,9 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: firecrawl
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: litellm
   to:
     - group: gateway.networking.k8s.io
       kind: Gateway