feat: load service adapters from ConfigMap, remove k8s API dependency

Adapters defined in config.yaml alongside routes and models.
Parsed by existing config loader, populated into registry at startup.
Removed: client-go deps, REST loader, informer, nginx proxy,
CiliumNetworkPolicy, apis/gateway/v1/ (duplicate types).
Kept: merged CI pipeline, imagePullPolicy Always, CA certs in Dockerfile.

Dockerfile

@@ -46,6 +46,10 @@ FROM gcr.io/distroless/static-debian12:nonroot
 # securityContext; if one changes, both must.
 USER 65532:65532
 
+# distroless/static has no CA certs. Copy them from the build stage so Go's
+# crypto/tls can verify the Kubernetes API server certificate.
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+
 COPY --from=build /out/gateway /gateway
 
 EXPOSE 8080