Let TerdutServer customize its pod, and never manage its own ingress

spec.pod (api/v1alpha1/terdutserver_types.go): annotations, nodeSelector,
tolerations, affinity, topologySpreadConstraints, resources, pod and
container securityContext, serviceAccountName, extraEnv/extraEnvFrom,
extraVolumes/extraVolumeMounts, imagePullSecrets, and an optional
disruptionBudget. All direct corev1 passthrough -- no wrapper types buy
anything for any of these, matching how CloudNativePG and the Zalando
postgres-operator both expose the same knobs, and matching this repo's
own SweeperSpec precedent ("wrap only when a round-trip through a
different type buys something"). affinity is pure user-supplied
passthrough, not a toggle-plus-generated-default the way a multi-replica
cluster operator's pod anti-affinity usually is: this operator never
auto-generates one, since spec.replicas above 1 isn't a supported
topology (the sweeper/notifier singleton constraint). Considered and
declined for this round: priorityClassName, pod labels beyond
annotations, and a HorizontalPodAutoscaler -- the last of those would
directly contradict the singleton constraint above.

disruptionBudget is the one field here that isn't a plain PodTemplateSpec
knob: when set, the controller now reconciles a PodDisruptionBudget
selecting the TerdutServer's own pods (new terdutserver_pdb.go); clearing
it deletes any it previously created. New RBAC marker on
poddisruptionbudgets to match.

Driven by a public-release pass: looking past this project's own use case
at what a mature, general-purpose operator CRD exposes here (researched
against Zalando postgres-operator and CloudNativePG specifically), not
just the fields this install happened to need.

Separately, and found while answering a question about exposing
TerdutServer through Istio instead of Gateway API: spec.networking's own
doc comment quietly promised a Gateway API HTTPRoute this operator would
build eventually ("a near-term follow-up, not deferred"). That promise is
wrong for a public release -- an operator managing someone's ingress
mechanism for them is a worse default than not touching it at all, and a
surprise HTTPRoute appearing once that follow-up eventually landed would
have been exactly backwards for an Istio (or plain-Ingress, or
intentionally-unexposed) install. Made the non-goal explicit and
permanent instead (DESIGN.md §1), removed the dead `gatewayListener`
field it was the only consumer of (zero runtime call sites anywhere --
setting it already had no effect, so this is a schema cleanup, not a
behavior change), and corrected ROADMAP.md's framing. hostname/servicePort
stay: both are live (TERDUT_PUBLIC_URL, container/Service port), this
operator just never acts on hostname for exposure. Added
examples/networking (Gateway API HTTPRoute, Istio VirtualService) showing
how to expose the plain ClusterIP Service the operator already creates --
outside the operator itself, as illustrations, not as something
examples/demo applies automatically.

No new terdut-server version requirement: both changes are CRD/controller-
only, nothing about the API this operator's bootstrap flow depends on
changed.

ROADMAP.md

@@ -72,15 +72,17 @@ New commits build forward over the old ones; no git history rewrite.
   individual keys, so there's nothing to undo there regardless.
 - RBAC: read-only watch on `postgresql.acid.zalan.do`, degrading gracefully
   if that CRD isn't installed (§8, §9).
-- Shipped, scoped down from §8's full ambition in two ways, both called out
-  in code rather than silently dropped: no live watch on the Zalando-
+- Shipped, scoped down from §8's full ambition in one way, called out in
+  code rather than silently dropped: no live watch on the Zalando-
   generated credentials Secret for rotation (relies on the periodic resync
-  to notice eventually, higher latency than a watch); no Gateway API
-  `HTTPRoute` creation from `spec.networking.hostname`/`gatewayListener`
-  (needs the Gateway API types as a new dependency, and nothing about
-  proving a `TerdutServer` boots and bootstraps a real server depends on
-  external ingress existing). Both are near-term follow-ups, not deferred
-  to a later stage.
+  to notice eventually, higher latency than a watch). A near-term
+  follow-up, not deferred to a later stage.
+- External exposure (a Gateway API `HTTPRoute` from
+  `spec.networking.hostname`) was originally sketched here too, as a
+  second near-term follow-up alongside the one above. It's since become an
+  explicit, permanent non-goal instead (DESIGN.md §1): the operator will
+  never manage ingress/exposure for `TerdutServer` in any form. See
+  `examples/networking` for how to do that yourself.
 - `envtest` covering Deployment/Service reconciliation and both database
   paths — the Zalando path needs that CRD's schema vendored into the test
   environment (there's no real `postgres-operator` controller in `envtest`,