fix(kanidm): add explicit group/kind/weight to TLSRoute refs

The Gateway API controller defaults group, kind, and weight on
parentRefs and backendRefs. ArgoCD diffs desired vs live by string
comparison, so omitting these fields causes permanent OutOfSync.
Same root cause as #162 (HTTPRoutes) but applied to TLSRoute.

apps/base/kanidm/tlsroute.yaml

@@ -13,9 +13,14 @@ spec:
     - auth.unkin.net
     - au.auth.unkin.net
   parentRefs:
-    - name: kanidm
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: kanidm
       sectionName: https-passthrough
   rules:
     - backendRefs:
-        - name: kanidm
+        - group: ""
+          kind: Service
+          name: kanidm
           port: 8443
+          weight: 1