docs(design): propose multi-port routes for NebariApp

Adds a design doc proposing an optional per-route port override on
RouteMatch so a single NebariApp can route different path prefixes to
different ports on the same backend Service under one hostname. Tightens
the same-namespace contract by removing ServiceReference.Namespace, and
codifies the "one NebariApp = one hostname = one backend Service"
boundary that has been implicit until now.

nebari-landing reads the namespace field for in-cluster health-probe DNS
construction but has graceful fallback to the NebariApp's own namespace,
and the original consumers (Keycloak/ArgoCD as NebariApps in the kind
dev cluster) have moved to NIC's foundational Argo-apps layer, so the
removal is non-breaking. A follow-up PR on nebari-landing should drop
the now-inert ServiceNamespace plumbing.

The streaming/BackendTrafficPolicy concern (Envoy SSE timeouts) is
covered in a separate design doc (docs/design/streaming-timeouts.md).

Filename kept as multi-backend-routes.md for URL stability; the doc
explains the rename.

Author: viniciusdc