feat(gateway-api): expose dsh-gateway externally via Traefik Gateway API (#12)

Add Gateway and HTTPRoute manifests to route external traffic to the
dsh-gateway service (dsh-demo:8080).

- Gateway dsh-gateway: HTTPS listener with TLS termination against a
  dsh-demo-tls cert secret.
- HTTPRoute dsh-gateway: hostname -> dsh-gateway:8080.
- Example TLS secret manifest + README with apply/verify/rollback.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

gateway-api/dsh-demo/tls-secret.yaml.example

@@ -0,0 +1,17 @@
+# EXAMPLE ONLY — do not apply as-is.
+#
+# Copy to tls-secret.yaml and populate with real base64-encoded PEM material,
+# then apply. The secret must live in the dsh-demo namespace and be named
+# "dsh-demo-tls" (referenced by gateway.yaml).
+#
+#   kubectl -n dsh-demo create secret tls dsh-demo-tls \
+#     --cert=tls.crt --key=tls.key --dry-run=client -o yaml > tls-secret.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dsh-demo-tls
+  namespace: dsh-demo
+type: kubernetes.io/tls
+data:
+  tls.crt: <base64-encoded-certificate>
+  tls.key: <base64-encoded-private-key>