Inline OTEL_TRACES_ENDPOINT so the proxy stack can actually deploy

This Kustomization pulled dataplane-template-defaults via substituteFrom
with optional: false, but that ConfigMap is deliberately single-instance
in flux-system and this object lives in the llm namespace, so the build
failed outright: configmaps "dataplane-template-defaults" not found.
That is why the stack was never in the cluster and the llm KongService,
KongRoute and plugin bindings had been applied by hand instead.

Moving the Kustomization to flux-system would fix the lookup and break
something worse: its substitution Secret holds OPENROUTER_BEARER and
LIBRECHAT_APIKEY, and copying real credentials into flux-system is
exactly what the Konnect PAT comment in gateway-kustomization.yaml
refuses to do.

OTEL_TRACES_ENDPOINT was the only key this stack took from that
ConfigMap, so inline it and drop the reference. The trade-off is
recorded next to the value: changing the cluster trace backend now takes
an edit here too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/proxy-kustomization.yaml

@@ -34,14 +34,18 @@ spec:
       # The URI path is the collector's routing key: Fluent Bit tags the
       # record `llm` and turns that into the Loki label domain=llm.
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/llm
+      # Duplicated from k8s-platform's dataplane-template-defaults ConfigMap
+      # rather than pulled via substituteFrom, because that ConfigMap is
+      # deliberately single-instance in flux-system and this Kustomization
+      # cannot live there: its substitution Secret below holds real
+      # credentials (OPENROUTER_BEARER, LIBRECHAT_APIKEY), and putting those
+      # in flux-system is the exact thing the Konnect PAT comment in
+      # gateway-kustomization.yaml refuses to do. Referencing the ConfigMap
+      # from the llm namespace just fails the build outright
+      # (optional: false), which is why this stack never deployed.
+      # Cost of the duplication: changing the cluster trace backend now takes
+      # an edit here too.
+      OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
     substituteFrom:
-      # Listed first so the Secret below still wins on any key it defines.
-      # Brings OTEL_TRACES_ENDPOINT, the cluster-wide trace backend, so this
-      # gateway follows a backend change without a second edit here. The only
-      # key it shares with the inline block above is OIDC_ISSUER, and both
-      # carry the same value.
-      - kind: ConfigMap
-        name: dataplane-template-defaults
-        optional: false
       - kind: Secret
         name: platform-llm-dev-secrets