Fix CloudSQL proxy labels to not match Backstage service selector

The CloudSQL proxy pod was using backstage.selectorLabels which made it
match the Backstage service selector (app.kubernetes.io/name: backstage,
app.kubernetes.io/instance: backstage). This caused Traefik to sometimes
route requests to the CloudSQL proxy instead of Backstage, resulting in
502 errors.

Changed pod labels to use distinct values (backstage-cloudsql-proxy)
so the pod is not selected by the Backstage service.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

templates/cloudsql-proxy-deployment.yaml

@@ -16,7 +16,8 @@ spec:
     metadata:
       labels:
         app: backstage-cloudsql-proxy
-        {{- include "backstage.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/name: backstage-cloudsql-proxy
+        app.kubernetes.io/instance: backstage-cloudsql-proxy
     spec:
       serviceAccountName: {{ .Values.cloudSqlProxyServiceAccount.name }}
       automountServiceAccountToken: true

values.yaml

@@ -19,8 +19,9 @@ service:
   targetPort: 7007
 
 # Ingress configuration
+# Disabled - using HTTPRoute (Gateway API) instead via Terraform
 ingress:
-  enabled: true
+  enabled: false
   className: nginx
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"