fix(webhook): refuse NetworkRule backends whose port differs from spec.port

[abhicodes-007]

Summary

• NetworkRuleValidator now calls validateBackendPorts on create/update: any backends[i].port != spec.port is refused with a DSR cannot-remap message.
• Gateway architecture doc: backend port must equal the rule port.
• Test: mismatch refused, match admitted.

Fixes #737

Test plan

• go test ./internal/webhook/ — pass
• Existing authorize tests still green

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Abhishek Deepak seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[privateip]

@abhicodes-007, thanks for the fix. Before this can merge, the license/cla check needs you to sign the Contributor License Agreement: https://cla-assistant.io/datum-cloud/galactic?pullRequest=738

The email on your commit isn't linked to your GitHub account, so the CLA check may stay pending even after you sign. To fix that, either add that email to your GitHub account under Settings → Emails, or re-author the commit with an email your account already has (git commit --amend --reset-author) and force-push.

[privateip]

Thanks for picking this up, @abhicodes-007. We're closing this without merging because the direction changed: port remapping is now supported (see #737), so refusing a backend port that differs from spec.port would block a working configuration.

Since #809, galactic-router writes the rule's spec.backendPort into each backend's ServiceVIPBinding, and the backend node's TC program rewrites VIP:port to backend:backendPort. network#29 and network#31 also replaced per-backend ports with a single spec.backendPort on the rule, so this change no longer applies to the current API either.