Add Envoy Gateway cookie-based session persistence for Guacamole OIDC

Fixes OIDC nonce validation failures with 2 replicas by using a
BackendTrafficPolicy with cookie-based consistent hashing instead of
Service-level ClientIP affinity (which doesn't work behind Envoy proxy).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/guacamole/manifests/deployment-complete.yaml

@@ -227,10 +227,6 @@ metadata:
     component: client
 spec:
   type: ClusterIP
-  sessionAffinity: ClientIP
-  sessionAffinityConfig:
-    clientIP:
-      timeoutSeconds: 3600
   ports:
     - port: 8080
       targetPort: http

apps/guacamole/manifests/envoy-gateway.yaml

@@ -74,3 +74,25 @@ spec:
           name: guacamole
           port: 8080
           weight: 1
+
+---
+# Cookie-based session persistence so OIDC nonce validation works across 2 replicas.
+# Without this, the OIDC callback can hit a different pod than the one that generated
+# the nonce, causing "Rejected OpenID token with invalid/old nonce" errors.
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: guacamole-session-persistence
+  namespace: guacamole
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: guacamole
+  loadBalancer:
+    type: ConsistentHash
+    consistentHash:
+      type: Cookie
+      cookie:
+        name: GUAC_ROUTE
+        ttl: 3600s