llm-proxy(app): gemma 反向代理 + token 鉴权 + /chat web UI

新 service，ns `llm-proxy`，域 `llm.famzheng.me`。
- POST /v1/chat/completions — OpenAI 兼容透传到 mochi 同款 backend
  gateway (gemma-4-31b-it)；一期强制 stream=false，SSE 留二期
- 鉴权: `Authorization: token <PROXY_AUTH_TOKEN>` 或同款 Bearer；
  常时间比较防 timing；空 expected 一律拒
- GET /chat — 自带极简 HTML chat UI（token 走 localStorage，
  附 curl example details）；/ 跳转到 /chat
- Secrets `llm-proxy/proxy-credentials` 已 kubectl 手工创建：
  BACKEND_TOKEN (上游) + PROXY_AUTH_TOKEN (对外)
- 13 个 cargo test 覆盖 auth 多个 scheme / 边界 + body
  改写 (stream=false 强制注入)

.gitea/workflows/deploy-llm-proxy.yml

@@ -0,0 +1,52 @@
+name: deploy llm-proxy
+# llm.famzheng.me — gemma 反向代理。host shell runner（fam 用户）。
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'apps/llm-proxy/**'
+      - 'crates/cube-core/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.gitea/workflows/deploy-llm-proxy.yml'
+  workflow_dispatch:
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    env:
+      APP: llm-proxy
+      IMAGE: registry.famzheng.me/mochi/llm-proxy
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve image tag
+        id: tag
+        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Build rust (musl static)
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          cargo build --release --target x86_64-unknown-linux-musl -p "$APP"
+
+      - name: Run tests
+        run: |
+          export PATH="$HOME/.cargo/bin:$PATH"
+          cargo test --release -p "$APP"
+
+      - name: Build & push image
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          echo "$REGISTRY_TOKEN" | docker login registry.famzheng.me -u mochi --password-stdin
+          docker build --no-cache -f "apps/$APP/Dockerfile" -t "$IMAGE:${{ steps.tag.outputs.sha }}" .
+          docker push "$IMAGE:${{ steps.tag.outputs.sha }}"
+
+      - name: Initialize K8s resources
+        run: kubectl apply -f "apps/$APP/k8s/all.yaml"
+
+      - name: Roll out to k3s
+        run: |
+          kubectl -n llm-proxy set image "deploy/$APP" "$APP=$IMAGE:${{ steps.tag.outputs.sha }}"
+          kubectl -n llm-proxy rollout status "deploy/$APP" --timeout=120s