llm-proxy(app): gemma 反向代理 + token 鉴权 + /chat web UI

新 service，ns `llm-proxy`，域 `llm.famzheng.me`。
- POST /v1/chat/completions — OpenAI 兼容透传到 mochi 同款 backend
  gateway (gemma-4-31b-it)；一期强制 stream=false，SSE 留二期
- 鉴权: `Authorization: token <PROXY_AUTH_TOKEN>` 或同款 Bearer；
  常时间比较防 timing；空 expected 一律拒
- GET /chat — 自带极简 HTML chat UI（token 走 localStorage，
  附 curl example details）；/ 跳转到 /chat
- Secrets `llm-proxy/proxy-credentials` 已 kubectl 手工创建：
  BACKEND_TOKEN (上游) + PROXY_AUTH_TOKEN (对外)
- 13 个 cargo test 覆盖 auth 多个 scheme / 边界 + body
  改写 (stream=false 强制注入)

apps/llm-proxy/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "llm-proxy"
+version = "0.1.0"
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+description = "llm.famzheng.me — gemma-4-31b-it 反向代理 + token 鉴权 + /chat web UI"
+
+[dependencies]
+cube-core = { path = "../../crates/cube-core" }
+axum = { workspace = true }
+tokio = { workspace = true }
+tower-http = { workspace = true }
+tracing = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+reqwest = { workspace = true }