Resolve ai-service directly from the RAG routes, never the gateway

.github/workflows/disable-api-gateway.yml

@@ -0,0 +1,22 @@
+name: Disable apiGateway on production (restore chat)
+
+# Emergency: enabling apiGateway sets API_GATEWAY_URL on the web pod, which
+# every BFF route prefers over AI_SERVICE_URL -- but the gateway only proxies
+# /auth/*, so chat/suggest/history/sections/section-text/feedback all break.
+# See the script docstring for the full trace.
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  disable:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Disable apiGateway and sync
+        env:
+          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
+          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
+        run: python3 .github/scripts/disable_api_gateway_live.py