feat(infra): api-gateway K8s API egress for pod listing

Allow api-gateway to reach the Kubernetes API server for pod listing
(Pods cockpit). Two CIDR blocks are needed because Cilium applies
NetworkPolicy after DNAT:
- 10.32.0.0/12:443 — kubernetes.default.svc ClusterIP
- 172.16.0.0/16:6443 — real node IP after Cilium DNAT

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/network-policies/api-gateway.yaml

@@ -102,3 +102,16 @@ spec:
       ports:
         - protocol: TCP
           port: 9000
+    # Kubernetes API (pod listing for Pods cockpit)
+    - to:
+        - ipBlock:
+            cidr: 10.32.0.0/12
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - ipBlock:
+            cidr: 172.16.0.0/16
+      ports:
+        - protocol: TCP
+          port: 6443