fix(infra): probe TWS API port 4002, use Recreate strategy

Readiness/liveness probes were checking port 4004 (socat), which
always listens even when the gateway is stuck at login — masking
failures. Now probes check port 4002 (TWS API), which only opens
after successful IBKR authentication.

Deploy strategy changed to Recreate because IBKR allows only one
session per account. RollingUpdate starts the new pod before killing
the old one, causing both to fight over the session in a crash loop.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/services/ib-gateway.yaml

@@ -8,6 +8,8 @@ metadata:
     app.kubernetes.io/part-of: foxhunt
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: ib-gateway
@@ -77,12 +79,12 @@ spec:
               cpu: "1000m"
           readinessProbe:
             tcpSocket:
-              port: 4004
+              port: 4002
             initialDelaySeconds: 90
             periodSeconds: 10
           livenessProbe:
             tcpSocket:
-              port: 4004
+              port: 4002
             initialDelaySeconds: 120
             periodSeconds: 30
             failureThreshold: 5