Move the AI gateway into the llm namespace and drop the inlining

ai-gateway-kustomization sat in flux-system, so the team's own bootstrap
was writing into a namespace the team has no access to — the thing the
move was meant to end. It follows the others into llm, with an explicit
sourceRef namespace since k8s-platform stays in flux-system.

The control-plane ExternalSecret goes with it, for the same reason it did
in the dataplane repos: it only lived in flux-system because
substituteFrom resolves in the Kustomization's own namespace.

And this retires a workaround. proxy-kustomization inlined
OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a
Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be
copied into flux-system — and could therefore not read
dataplane-template-defaults, which existed only there. k8s-platform now
places that ConfigMap in every domain namespace, so the reference works
and the duplicated value goes. Changing the cluster trace backend is one
edit again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/ai-gateway-kustomization.yaml

@@ -2,12 +2,16 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: llm-dev-ai-gateway
-  namespace: flux-system
+  namespace: llm
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: k8s-platform
+    # k8s-platform lives in flux-system: the templates are the platform's,
+    # this Kustomization is the team's. sourceRef resolves in the
+    # Kustomization's own namespace unless told otherwise.
+    namespace: flux-system
   path: ./dataplane-template
   prune: true
   postBuild: