Stage 4: TerdutAlertSource

Covers webhook Secret generation/ownership (DESIGN.md §4.5, §7), the
WebhookSecretLost fail-closed condition, and the kind-change
delete-and-recreate rotation path.

Idempotent-create here is deliberately neither adopt-on-409
(Team/service-account) nor list-and-match-by-name (TerdutDeadmanSwitch):
terdut-server shows the webhook key exactly once, at creation, and never
again, so no server-side lookup could ever recover it after a crash.
Instead the generated webhook Secret itself -- written immediately after
the POST, before status is ever touched -- is this CR's only durable
record that a create already succeeded; found with status.integrationID
still unset on a later reconcile, it's read back directly rather than
POSTing a second, orphaned integration. Found missing with
status.integrationID *set* instead, that's the already-designed
WebhookSecretLost case: fail closed, not self-healed, since the key is
genuinely gone and recreating it would rotate a live webhook URL with no
spec change to explain why.

Renaming (PATCH) never touches the key, so it's applied unconditionally
every reconcile, same as the escalation policy's whole-policy PUT. A
spec.kind change is the one case with no in-place update verb at all:
DELETE the old integration, delete the stale webhook Secret, then run the
same create path fresh -- fires a Warning event since this breaks whatever
still sends to the old URL.

Also: fakeTerdutServer grows POST/PATCH/DELETE .../integrations routes
behind a new handleIntegrationSubPath, split out of handleTeamSubPath to
stay under gocyclo's threshold; three goconst-flagged test literals
("does-not-exist", "unready") and one unparam-flagged test helper
parameter (bootstrapReadyTerdutServer's always-"default" namespace) get
shared/removed now that a fourth same-shaped caller made the repetition
concrete enough for the linter to flag.

DESIGN.md §13 gains one honest gap found while grounding this stage, not
introduced by it: no child CRD specially detects a mid-life teamRef
change; all three always resolve spec.teamRef fresh and trust the
already-stored server-side id remains valid there.

make fmt lint test build all clean; internal/controller envtest coverage
holds at 71.6%.

internal/tdclient/client.go

@@ -23,6 +23,10 @@ import (
 // fieldName is the JSON key every create/rename request body below shares.
 const fieldName = "name"
 
+// fieldKind is the JSON key an integration's create request body shares
+// with the terdutv1alpha1.TerdutAlertSourceSpec field of the same name.
+const fieldKind = "kind"
+
 type Client struct {
 	baseURL    string
 	httpClient *http.Client
@@ -496,3 +500,69 @@ func (c *Client) DeleteDeadmanSwitch(ctx context.Context, teamID, switchID int64
 	}
 	return c.do(req, nil)
 }
+
+// Integration mirrors terdut-server's models.Integration, minus
+// CreatedAt/LastUsedAt, which this client never reads. Key/URL are only
+// ever populated by CreateIntegration's own response -- the one moment
+// either value exists outside terdut-server's own database (DESIGN.md
+// §4.5: shown once, never re-readable, same handling as the bootstrap
+// admin key).
+type Integration struct {
+	ID     int64  `json:"id"`
+	TeamID int64  `json:"team_id"`
+	Kind   string `json:"kind"`
+	Name   string `json:"name"`
+	Key    string `json:"key,omitempty"`
+	URL    string `json:"url,omitempty"`
+}
+
+// CreateIntegration calls POST /api/teams/{teamID}/integrations --
+// owner-gated (requireTeamOwner), so c must hold this team's own
+// team-scoped credential. No conflict handling exists server-side at all
+// for this resource (no unique constraint on name, confirmed against
+// source) -- deliberately not treated as this resource's idempotent-create
+// recovery path; see the controller's own reasoning for why a crash
+// between this call succeeding and the webhook Secret being written can't
+// be recovered by listing and adopting a same-named row the way
+// TerdutDeadmanSwitch does.
+func (c *Client) CreateIntegration(ctx context.Context, teamID int64, name, kind string) (*Integration, error) {
+	req, err := c.newRequest(ctx, http.MethodPost, fmt.Sprintf("/api/teams/%d/integrations", teamID),
+		map[string]string{fieldName: name, fieldKind: kind})
+	if err != nil {
+		return nil, err
+	}
+	var integ Integration
+	if err := c.do(req, &integ); err != nil {
+		return nil, err
+	}
+	return &integ, nil
+}
+
+// RenameIntegration calls PATCH /api/teams/{teamID}/integrations/{integrationID}
+// -- owner-gated, same credential requirement as CreateIntegration. Never
+// touches the key (terdut-server's own handler comment: "the key is
+// untouched, so nothing posting with it notices"), so this is safe to call
+// every reconcile unconditionally rather than only on detected drift --
+// the same "cheap, so just always sync it" reasoning TerdutEscalationRule's
+// whole-policy PUT uses.
+func (c *Client) RenameIntegration(ctx context.Context, teamID, integrationID int64, name string) error {
+	req, err := c.newRequest(ctx, http.MethodPatch,
+		fmt.Sprintf("/api/teams/%d/integrations/%d", teamID, integrationID),
+		map[string]string{fieldName: name})
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}
+
+// DeleteIntegration calls DELETE /api/teams/{teamID}/integrations/{integrationID}
+// -- owner-gated, same credential requirement as CreateIntegration. Used
+// both by the finalizer and by the kind-change rotation path (DESIGN.md §5).
+func (c *Client) DeleteIntegration(ctx context.Context, teamID, integrationID int64) error {
+	req, err := c.newRequest(ctx, http.MethodDelete,
+		fmt.Sprintf("/api/teams/%d/integrations/%d", teamID, integrationID), nil)
+	if err != nil {
+		return err
+	}
+	return c.do(req, nil)
+}