docs: explain Envoy upstream Host port workaround

[woodgear]

Summary

• explain the difference between the backend socket port, HTTP Host or authority, and TLS SNI
• document the auto_host_rewrite behavior for non-default Backend ports
• provide a scoped EnvoyPatchPolicy workaround and xDS-based verification steps
• use sanitized example domains, namespaces, resource names, and addresses
• state that the exact JSON Patch configuration was validated with Envoy Gateway v1.8.0 and Envoy v1.38.0

Validation

• corepack yarn build
• Markdown diff check
• all five referenced documentation and issue links returned HTTP 200

Related

• Generated Backend host rewrite drops non-default port from upstream authority envoyproxy/ai-gateway#2500

This PR is for review only and has not been merged.