Skip backend cert verification for L7 re-encrypt routes

When backend_tls=true, the h2 transport was verifying the backend's
TLS certificate. This fails when the backend address is an IP (no
IP SANs) or uses a self-signed cert. Backend connections are to
trusted internal services — skip verification. Also change rift
metrics port to 9091 to avoid conflict with exod on 9090.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/mc-proxy-rift.toml

@@ -52,7 +52,7 @@ rate_window       = "1m"
 
 # Prometheus metrics — loopback only, for node-local MCP scraping.
 [metrics]
-addr = "127.0.0.1:9090"
+addr = "127.0.0.1:9091"
 path = "/metrics"
 
 [proxy]