bug(pipelines): Installation guide does not state that pod-to-pod TLS is standalone-only

**This is a Bug Report**

**Problem:**

The "Deploying Kubeflow Pipelines with Pod-to-Pod TLS Enabled" section of the installation guide presents pod-to-pod TLS as a general deployment option:

> Kubeflow Pipelines can be deployed with pod-to-pod TLS enabled. The API server serves over TLS, and all connecting deployments are mounted with CA certificates.

In practice this applies to standalone deployments only. Pod-to-pod TLS is not available in multi-user mode, and the documentation does not say so.

Evidence:

- The only pod-to-pod TLS overlay in the repository is `manifests/kustomize/env/cert-manager/platform-agnostic-standalone-tls`, which is standalone, as its name indicates. There is no multi-user equivalent on `master`.
- In `.github/resources/scripts/deploy-kfp.sh`, the standalone branch selects a `tls-enabled` manifest when pod-to-pod TLS is requested. The multi-user branch does not reference the TLS flag at all — manifest selection there depends only on the database type, artifact proxy, and cache settings.

Because the current wording does not scope the feature, an operator running multi-user can reasonably conclude that pod-to-pod TLS is available to them. It is not, and nothing in the deployment path signals that, so the setting appears to be accepted while traffic between pods is not encrypted by this mechanism.

**Proposed Solution:**

State in the pod-to-pod TLS section that the feature applies to standalone deployments only, and that no multi-user pod-to-pod TLS overlay exists.

If multi-user deployments are expected to obtain in-mesh traffic encryption from Istio instead — multi-user mode requires Istio — then the section should say that as well, and point to the relevant configuration. That distinction determines whether the fix is a wording change alone or should also cover what multi-user operators are meant to use.

**Page to Update (provide the full path):**
https://www.kubeflow.org/docs/components/pipelines/operator-guides/installation/#deploying-kubeflow-pipelines-with-pod-to-pod-tls-enabled

**Component/Kubeflow Version:**
Kubeflow Pipelines, `master` (verified against the current `manifests/kustomize/env` tree and `deploy-kfp.sh`)

### Labels

/area pipelines

Impacted by this bug? Give it a 👍.

Open the installation page section linked in the issue, then compare its wording with manifests/kustomize/env/cert-manager/platform-agnostic-standalone-tls and .github/resources/scripts/deploy-kfp.sh. Confirm the standalone-only scope and check the relevant multi-user or Istio configuration before updating the documentation. Done means operators can tell which deployment modes support pod-to-pod TLS and what multi-user deployments should use instead.

Written by the indexing model from the issue text.