refactor: remove HAProxy from Prospero, centralize TLS on Titania

Move TLS termination and reverse proxying entirely to Titania's
HAProxy, eliminating the redundant HAProxy instance on Prospero.
Backends now communicate over plain HTTP within the internal network.

- Remove HAProxy container, config, certs, and syslog from Prospero
- Remove ssl_backend flags from Titania backend definitions
- Replace pplg_haproxy_* vars with single pplg_domain variable
- Remove HAProxy syslog source from Alloy config
- Update OAuth2-Proxy to listen on all interfaces for Titania access

ansible/pplg/pgadmin.service.j2

@@ -9,7 +9,7 @@ User={{pgadmin_user}}
 Group={{pgadmin_group}}
 WorkingDirectory=/usr/pgadmin4/web
 ExecStart=/usr/pgadmin4/venv/bin/python3 -m gunicorn pgAdmin4:app \
-    --bind 127.0.0.1:{{pgadmin_port}} \
+    --bind 0.0.0.0:{{pgadmin_port}} \
     --workers 1 \
     --threads 4 \
     --timeout 120 \