Add multi-tenant ALB routing example

[FloMicSch]

Description

Adds examples/alb-multi-tenant-routing: one Application Load Balancer in front of several applications. app.<domain> and admin.<domain> share a single HTTPS listener with one certificate each (selected by SNI); the app host carries path routing with an exact-match legacy endpoint, a header rule (X-Canary: true) and a query-parameter rule (preview=true) to a canary pool and a WebSocket route; the admin host uses cookie persistence. Every application has its own target pool with an active HTTP health check. Two backend VMs in different availability zones serve every pool, and each response names the pool and the VM that answered, so every rule can be verified from the response body.

The existing ALB examples use a single wildcard host in front of a single target pool; this example covers the layer 7 routing features that were not shown yet:

• Host, path (prefix and exact_match), header and query parameter rules, and the first-match-in-order semantics they depend on
• cookie_persistence, web_socket, one active_health_check with http_health_checks per pool
• Two stackit_alb_certificates on one listener, options.ephemeral_address = true (no reserved public IP)
• The backend application lives in files/server.py and is injected into cloud-init via templatefile

Tested

Deployed end to end in a sandbox project (eu01, provider 0.113.0); the README's Testing section lists the commands and the observed results:

• All routing rules including the negative cases (segment-boundary prefixes, case-sensitive header and query values, unknown hosts answered with 404 by the load balancer)
• SNI certificate selection, cookie persistence, WebSocket upgrade (101) on /ws and 403 on a route without web_socket
• Per-pool health checks: a failing application leaves its own pool only, the other pools on the same VM keep serving
• terraform fmt, terraform validate, pre-commit hooks (prettier, black, gitleaks, addlicense, README tags, file naming) pass; AGENTS.md regenerated

Notes

• stackit beta alb plans lists only p10 in eu01 at the time of writing; the plan is a variable with that default.
• In a project that belongs to a STACKIT Network Area, network_cidr has to lie inside the ranges of the area; the README says so.

Checklist

• The CI pipeline passed successfully.