Fix Guacamole OIDC session persistence via Istio DestinationRule

Traffic goes through Istio (not Envoy Gateway), so cookie-based
consistent hashing must be on the Istio DestinationRule. Removes
the unused Envoy Gateway BackendTrafficPolicy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/guacamole/manifests/envoy-gateway.yaml

@@ -74,25 +74,3 @@ spec:
           name: guacamole
           port: 8080
           weight: 1
-
----
-# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
-# Without this, the OIDC callback can hit a different pod than the one that generated
-# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: BackendTrafficPolicy
-metadata:
-  name: guacamole-session-persistence
-  namespace: guacamole
-spec:
-  targetRefs:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      name: guacamole
-  loadBalancer:
-    type: ConsistentHash
-    consistentHash:
-      type: Cookie
-      cookie:
-        name: GUAC_ROUTE
-        ttl: 3600s