feat(consul): address PR review feedback

- Fix consul HTTPRoute backend: consul-consul-ui -> consul-ui
- Add consul.service.consul hostname to Gateway (cert SAN) and HTTPRoute
- Add consul-svc listener on 443 for consul.service.consul SNI routing
- Convert PDB inline patch to patches/consul-server-pdb.yaml
- Set server.disruptionBudget.maxUnavailable: 1 explicitly in values
- Expose consul DNS service as LoadBalancer (purelb 198.18.200.5) for anycast
- Remove sandbox overlay (not needed in production GitOps)

apps/overlays/au-syd1/consul/values.yaml

@@ -12,6 +12,9 @@ server:
 
   connect: true
 
+  disruptionBudget:
+    maxUnavailable: 1
+
   extraConfig: |
     {
       "disable_remote_exec": true,
@@ -49,3 +52,7 @@ connectInject:
 
 dns:
   enabled: true
+  type: LoadBalancer
+  annotations: |
+    purelb.io/service-group: "common"
+    purelb.io/addresses: 198.18.200.5