feat(stargate): reject unsupported server identities in secure mode

Problem

Stargate generates a self-signed server identity when both TLS certificate and
private key inputs are absent. Setting quic_insecure=false controls outbound
certificate verification, but it does not disable this inbound server fallback.

Self-managed secure PKI deployments need an explicit fail-closed server identity
policy. Missing, implicit, or explicitly self-signed service identities must not
start a secure reverse QUIC listener.

Required behavior

• Add explicit development and strict server identity policies.
• Preserve generated self-signed identities only in explicit development mode.
• Require both certificate and private key material in strict mode.
• Reject malformed material, a mismatched private key, and an empty certificate
  chain.
• Reject an explicitly self-signed service leaf in strict mode.
• Reject a CA certificate used as the service leaf.
• Reject an expired, not-yet-valid, or non-server certificate.
• Validate the service leaf against the effective advertised hostname.
• Fail before opening the reverse QUIC listener when strict validation fails.
• Do not fall back to generated identity or insecure verification after failure.

Chart integration

• Expose the policy through the LLM request-router chart.
• Select strict policy for the self-managed secure PKI profile.
• Keep existing development behavior for non-secure development installs.
• Apply the same strict validation to cert-manager identities and any future
  existing-Secret identity source.

Acceptance criteria

• Strict mode with missing certificate or key material fails startup.
• Strict mode rejects a generated or explicitly supplied self-signed service
  leaf.
• Strict mode accepts a valid CA-issued service identity with a matching key and
  advertised hostname.
• The request-router does not become ready after strict identity validation
  fails.
• Unit and chart tests cover strict and development behavior.
• End-to-end validation records the valid and fail-closed cases.

Related

Relates to #19.

Follow-up to #51.

Start at Stargate's reverse QUIC listener and server-identity generation, then inspect the LLM request-router chart and its cert-manager identity integration. Done means strict and development policies behave as specified, invalid identities fail before listener readiness, and unit, chart, and end-to-end tests cover valid and fail-closed cases.