feat(addons): Enable ML/AI layer addons for cloudfront-exposure

Parent: #699

## Addons

- [ ] `jupyterhub` — interactive notebooks (needs ingress with path rewrite)
- [ ] `ray_operator` — distributed compute for Ray Serve/Train
- [ ] `spark_operator` — Spark job execution

## CloudFront Ingress Changes Needed

- `jupyterhub`: needs `/jupyterhub` path + transforms annotation + websocket support

## Dependencies

- `jupyterhub` may need `aws_efs_csi_driver` for persistent notebook storage
- `ray_operator` and `spark_operator` have no ingress — just enable them
- ML templates in Backstage (`ray-serve-cpu`, `ray-serve-gpu`, `spark-job`) depend on these operators being available

## Not Enabled on Main Hub (optional)

- `kubeflow` — disabled in hub-config.yaml
- `mlflow` — disabled in hub-config.yaml
- `airflow` — disabled in hub-config.yaml

These can be added later if specific workshop exercises require them.

Start with parent issue #699 and the existing addon configuration, then inspect hub-config.yaml and the Backstage templates named ray-serve-cpu, ray-serve-gpu, and spark-job. Enable jupyterhub, ray_operator, and spark_operator; add the listed jupyterhub ingress path, transforms annotation, and websocket support, while leaving kubeflow, mlflow, and airflow disabled.

Written by the indexing model from the issue text.