Deploy sales/dev dataplane (Layer 2), mirroring catalog/customers/payments

Real Konnect Control Plane 84a3dd19-7daf-47e6-84ea-9ad5966b91a6, PAT
in Vault (kong-v2/sales/dev/konnect-pat). Replaces the TODO stubs
with the proven gateway-kustomization.yaml + externalsecret.yaml +
policies-kustomization.yaml pattern. JWT_AUDIENCE_WHITELIST includes
mcp-sales from the start since Layer 3 (REST + MCP) was built the
same session — see STATUS.md section 22.

dev/api-gateway/externalsecret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sales-dev-konnect-auth
+  namespace: sales
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: sales-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/sales/dev/konnect-pat
+        property: token