Migrate public service routing to Envoy Gateway

[prayujt]

Public HTTP deployments currently create NGINX Ingress objects. This migrates deployment and cleanup to Envoy Gateway HTTPRoute/GRPCRoute resources, preserving custom domains, stored preview hostnames, and the existing API/configuration fields.

• Configure routing explicitly with Nimbus-owned envoy.nimbus.dev/* annotations. Supported NGINX keys remain deprecated aliases; conflicting settings and unknown Envoy keys are rejected.
• Support gRPC h2c backends, separate connection/request/stream timeouts, exact protobuf service/method matching, and opt-in retry counts/triggers/per-attempt timeouts. Backend TLS and multiple rule sets are not exposed by this interface.
• Reconcile per-service TLS, redirects, policies, and owned listeners without replacing other applications' Gateway listeners. Preserve combined auth/CORS and add an isolated helper for external-auth redirects and SPA fallback.
• Gate legacy ingress retirement on route/policy acceptance, certificates, and helper readiness. Preserve existing certificate private-key settings and retain cleanup records on errors.
• Document server prerequisites and the supported settings; add Go tests and pinned Envoy schema/xDS validation in CI.

Validation: Go 1.25.1 race tests and vet passed. Generated HTTP, gRPC, SPA, auth, and CORS resources passed strict schema validation and offline Envoy 1.9.1 translation, including gRPC method matching and retries. Live browser sessions and deployments have not been exercised with this Nimbus version.

Nothing has been deployed. Rollout requires the configured Envoy Gateway/cert-manager integration and, for auth or SPA services, a digest-pinned image built from this Nimbus version in NIMBUS_ROUTE_HELPER_IMAGE. Existing services migrate when redeployed; there is no startup-wide migration or transactional rollback. The README documents the shared Gateway's listener limit and deployment timeout considerations.