feat(consensus): proxy CR support (HAProxy/Envoy)

Create HAProxyCapsule or EnvoyProxy CR when `--with-proxy` flag is set during consensus node install.

Parent epic: #408
Depends on: #1044

### Scope
- `--with-proxy haproxy|envoy` flag (already exists in node.go)
- Create HAProxyCapsule CR when `--with-proxy=haproxy`
- Create EnvoyProxy CR when `--with-proxy=envoy`
- Associate proxy CR with the ConsensusCapsule
- Rollback: delete proxy CR if created by this step

### Acceptance Criteria
- [ ] HAProxyCapsule created with correct spec when `--with-proxy=haproxy`
- [ ] EnvoyProxy created with correct spec when `--with-proxy=envoy`
- [ ] Proxy CR references the correct ConsensusCapsule
- [ ] No proxy created when flag is empty (default)
- [ ] Rollback support