Fix Guacamole OIDC session persistence via Istio DestinationRule

Traffic goes through Istio (not Envoy Gateway), so cookie-based
consistent hashing must be on the Istio DestinationRule. Removes
the unused Envoy Gateway BackendTrafficPolicy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/guacamole/manifests/istio-virtualservice.yaml

@@ -14,3 +14,21 @@ spec:
             host: guacamole.guacamole.svc.cluster.local
             port:
               number: 8080
+
+---
+# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
+# Without this, the OIDC callback can hit a different pod than the one that generated
+# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: guacamole
+  namespace: guacamole
+spec:
+  host: guacamole.guacamole.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        httpCookie:
+          name: GUAC_ROUTE
+          ttl: 3600s