Bind HTTPRoutes to specific Gateway listeners

[Shine-neko]

Summary

The Gateway provider treated every Gateway as an opaque (namespace, name) and never read its spec.listeners[]. So a route's parentRef.sectionName / parentRef.port was ignored (a route bound to the whole Gateway regardless), and a listener's hostname didn't narrow what the route served. This wires listener selection and hostname narrowing through the scope.

This is the provider-only half of "listener-driven port binding" — the genuinely useful, self-contained part. Actually serving traffic on each listener's own port (multiple live HTTP ports from one Gateway) needs dynamic Sōzu HTTP-listener creation, which doesn't exist yet; that is left as a separate, larger change (noted in the docs).

What changed

• Listener-aware scope — ScopeState.gateways goes from HashSet<(ns,name)> to HashMap<(ns,name), Vec<ListenerInfo>>, keeping each listener's name, port, and hostname. upsert_gateway now also notifies when an accepted Gateway's listener set changes (not just on in/out-of-scope flips), so a listener edit re-resolves dependent routes.
• parentRef.sectionName / parentRef.port — accepts_parent_ref resolves these against the Gateway's listeners: sectionName must equal a listener name, port must equal a listener port, and when both are set the same listener must satisfy both. An unset sectionName/port still binds to the whole Gateway (unchanged behaviour). A ref naming a listener the Gateway doesn't have is refused (route out of scope → 404).
• Listener hostname narrowing — a listener with a hostname only serves route hostnames that match it (exact, or a shared suffix for a single leading *. wildcard). A route with no hostnames inherits the listener's. When no bound listener admits any of the route's hostnames, the route resolves to nothing on that Gateway.

Tests

• 11 new unit tests: listener selection (unset binds any, sectionName/port must match, both must be satisfied by one listener), hostname intersection (pass-through, narrowing, no-overlap→none, inherit), wildcard compatibility, scope refuses an unknown-listener ref, scope notifies on a listener-set change.
• e2e (02-gateway.sh + gateway-manifests.yaml): a route with sectionName: http (an existing listener) is served (200); a route with sectionName: ghost (no such listener) is refused (404). Verified end-to-end on kind against a local image build: 35 passed, 0 failed.
• cargo fmt --check, clippy clean; full unit suite 697 passed.

Docs

Kubernetes provider docs: sectionName/port and listener-hostname narrowing moved from "not supported" to the honoured-features list, with the remaining multi-port-binding gap called out explicitly.