Re-enable Ceph dashboard SSL to fix SAML http/https URL mismatch

X-Forwarded-Proto approach didn't work - Ceph dashboard SAML doesn't
read it. Re-enabling native SSL so the dashboard sees https:// URLs
directly. Updated both Istio and Envoy Gateway backends for TLS with
insecureSkipVerify for the self-signed cert.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/rook-ceph/manifests/envoy-backend.yaml

@@ -7,4 +7,7 @@ spec:
   endpoints:
     - fqdn:
         hostname: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
-        port: 7000
+        port: 8443
+  tls:
+    insecureSkipVerify: true
+    sni: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local

infrastructure/rook-ceph/manifests/envoy-route.yaml

@@ -17,12 +17,6 @@ spec:
         - path:
             type: PathPrefix
             value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Proto
-                value: https
       backendRefs:
         - group: gateway.envoyproxy.io
           kind: Backend

infrastructure/rook-ceph/manifests/istio-destinationrule.yaml

@@ -7,4 +7,6 @@ spec:
   host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
   trafficPolicy:
     tls:
-      mode: DISABLE
+      mode: SIMPLE
+      sni: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
+      insecureSkipVerify: true

infrastructure/rook-ceph/manifests/istio-virtualservice.yaml

@@ -9,13 +9,9 @@ spec:
   gateways:
     - istio-system/edge
   http:
-    - headers:
-        request:
-          set:
-            x-forwarded-proto: https
-      timeout: 3600s
+    - timeout: 3600s
       route:
         - destination:
             host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local
             port:
-              number: 7000
+              number: 8443