feat(consul): address PR review feedback

- Fix consul HTTPRoute backend: consul-consul-ui -> consul-ui
- Add consul.service.consul hostname to Gateway (cert SAN) and HTTPRoute
- Add consul-svc listener on 443 for consul.service.consul SNI routing
- Convert PDB inline patch to patches/consul-server-pdb.yaml
- Set server.disruptionBudget.maxUnavailable: 1 explicitly in values
- Expose consul DNS service as LoadBalancer (purelb 198.18.200.5) for anycast
- Remove sandbox overlay (not needed in production GitOps)

apps/base/consul/gateway.yaml

@@ -12,6 +12,7 @@ metadata:
     cert-manager.io/cluster-issuer: vault-issuer
     cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
     cert-manager.io/private-key-size: "4096"
+    cert-manager.io/subject-alternative-names: consul.service.consul
     external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
     external-dns.alpha.kubernetes.io/target: 198.18.200.4
 spec:
@@ -29,3 +30,15 @@ spec:
         certificateRefs:
           - kind: Secret
             name: consul-tls
+    - name: consul-svc
+      port: 443
+      protocol: HTTPS
+      hostname: consul.service.consul
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            name: consul-tls