feat(console): support logical TLS worker origins

[EdsonPetry]

What changed

• Adds --worker-origin, --ca-cert, and --connect-timeout to the console.
• Separates logical gRPC/TLS identity from the physical TCP target.
• Applies one transport policy to seed discovery, polling, and reconnects.
• Supports bare authorities, IPv4, IPv6, explicit/default ports, and custom trust roots.
• Reconnects workers concurrently.

Why

Fabric certificates identify the logical service name, while worker discovery returns physical pod addresses. The console must dial each pod address but use the logical service for TLS SNI, certificate verification, and gRPC authority.

Impact

Legacy plaintext invocation remains supported. Operators can run the console inside a personal devkube pod against every discovered worker through Fabric TLS.

This branch also changes the default poll interval from 100 ms to 1 s. Reviewers should confirm that change belongs here or request a split.

Review focus

• Verify TLS SNI and HTTP/2 :authority use the logical worker origin while TCP dials the discovered physical address.
• Decide whether --ca-cert with an http:// origin should fail instead of being ignored.
• Confirm connect timeouts cover discovery, polling, and reconnect paths.

Validation

• 15 console tests passed on the original feature base.
• Live TLS seed discovery found all three workers.
• Formatting passed after rebasing onto the Arrow 58/59 integration branch.
• Full local test/clippy builds exhausted host file descriptors while compiling aws-sdk-ec2; official CI is required before merge.

Stack

Depends on #25. Review this PR after the connector seam is accepted. If #25 is squash-merged, rebase this branch before merge so this diff contains only TLS-origin changes.

Ports EdsonPetry/datafusion-distributed#3 to the DataDog compatibility branch.