When backend_tls=true, the h2 transport was verifying the backend's TLS certificate. This fails when the backend address is an IP (no IP SANs) or uses a self-signed cert. Backend connections are to trusted internal services — skip verification. Also change rift metrics port to 9091 to avoid conflict with exod on 9090. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>