Configure Istio mTLS STRICT for backend/frontend/analytics

[snowrugar-beep]

• Problem Statement. k8s/istio/* files exist but actual
  PeerAuthentication policies are not defined.
• Why it matters. Sidecar mesh without mTLS is the worst
  combo.
• Expected Outcome. PeerAuthentication mesh-wide STRICT;
  exceptions scoped to debug namespaces.
• Acceptance Criteria.
  1. Kiali shows 100 % mesh-mTLS traffic.
• Files / Modules. k8s/istio/**.
• Difficulty. Medium.
• Effort. 1 day.
• Labels. k8s, mesh, security.