[CF-31] App service gateway and cilium routing

[jtomasevic]

Summary

• Added app-service-specific Gateway API routing with deterministic HTTPRoute names derived from app service IDs.
• Extended Gateway route models to support explicit path rules, backend namespaces, labels, Swagger/OpenAPI routes, and optional docs-adapter backends.
• Added app-service-specific Cilium ingress policies scoped by tenant, network, subnet, app service ID, public visibility, and exposed port.
• Kept existing network-level gateway routing compatible while adding idempotent app-service route and policy create/delete helpers.
• Added Gateway and Cilium repository READMEs documenting app-service exposure behavior, cleanup, and Swagger/OpenAPI routing.
• Regenerated CF-Provisioner service mocks for the expanded Gateway/Cilium interfaces.
• Added unit coverage for app-service route creation, no placeholder backend usage, docs routing, idempotent updates/deletes, and scoped Cilium policies.

Validation

• go test ./internal/repository/gateway ./internal/repository/cilium
• go test ./... from services/cf-provisioner
• make lint
• make test
• make build
• git diff --check