[BUG] K8s ingress hardcodes protocol("http://") + TODO for all backends (TLS silently downgraded)

## Description
All k8s ingress parsers build `DivideUpstream` with `upstream.setProtocol("http://")` hardcoded, with `// TODO support config protocol in annotation`. Until implemented, TLS/HTTPS ingress backends are mis-proxied as plain HTTP.

## Location
```
shenyu-kubernetes-controller/.../parser/DivideIngressParser.java:177-178,324-325
.../reconciler/EndpointsReconciler.java:159-160
.../reconciler/IngressReconciler.java:629,643-644
```

## Impact
Functional correctness + security (TLS downgrade) in the k8s controller.

## Suggested fix
Wire a `nginx.ingress.kubernetes.io/backend-protocol` (or ShenYu-specific) annotation to select `https://`/`grpcs://`; default safe.

## Related existing issue(s)
None

_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._

Start with the hardcoded setProtocol("http://") calls in DivideIngressParser.java, EndpointsReconciler.java, and IngressReconciler.java. Trace how ingress annotations are available in these entry points and determine the supported backend-protocol values and safe default. Done means HTTPS or gRPC backends are not downgraded and plain HTTP remains the default when no protocol annotation is present.

Written by the indexing model from the issue text.