Fix Guacamole OIDC session persistence via Istio DestinationRule

Traffic goes through Istio (not Envoy Gateway), so cookie-based
consistent hashing must be on the Istio DestinationRule. Removes
the unused Envoy Gateway BackendTrafficPolicy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/guacamole/manifests/envoy-gateway.yaml

@@ -74,25 +74,3 @@ spec:
           name: guacamole
           port: 8080
           weight: 1
-
----
-# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
-# Without this, the OIDC callback can hit a different pod than the one that generated
-# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
-apiVersion: gateway.envoyproxy.io/v1alpha1
-kind: BackendTrafficPolicy
-metadata:
-  name: guacamole-session-persistence
-  namespace: guacamole
-spec:
-  targetRefs:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      name: guacamole
-  loadBalancer:
-    type: ConsistentHash
-    consistentHash:
-      type: Cookie
-      cookie:
-        name: GUAC_ROUTE
-        ttl: 3600s

apps/guacamole/manifests/istio-virtualservice.yaml

@@ -14,3 +14,21 @@ spec:
             host: guacamole.guacamole.svc.cluster.local
             port:
               number: 8080
+
+---
+# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
+# Without this, the OIDC callback can hit a different pod than the one that generated
+# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: guacamole
+  namespace: guacamole
+spec:
+  host: guacamole.guacamole.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        httpCookie:
+          name: GUAC_ROUTE
+          ttl: 3600s