The ingress example was using the old per-ingress proxy pattern with
rules/host, which doesn't work with ProxyGroup routing. Updated to
match the current pattern: proxy-group annotation, defaultBackend
instead of rules, and tls.hosts for MagicDNS hostname.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>