Stage 1: TerdutServer full lifecycle (Deployment, Service, both database

paths, self-registration bootstrap)

Replaces the bring-your-own-only Stage 1 (commit 1be7cf2) wholesale, per
the redesign in the previous two commits: the operator creates every
server it manages, so self-registration (DESIGN.md §6) is the only
bootstrap path, and Deployment/Service/database management builds
together with it (ROADMAP.md Stage 1) rather than behind a separate
later stage.

Grounded in terdut-server's actual chart (charts/terdut-server/templates/
deployment.yaml, values.yaml), not reconstructed from DESIGN.md's
illustrative YAML alone -- env var names, the password-via-PGPASSWORD
convention, the Recreate deployment strategy, /healthz probes, and the
TERDUT_OPERATOR_MODE=true decision (always on here, unlike the chart's
default-off: every write this operator's own future controllers make
goes through a service account already) all match that source exactly.

- api/v1alpha1: full TerdutServerSpec (image, replicas, networking,
  database, sweeper, deadman, notify, oidc, passwordLogin, allowedTeams).
  spec.database is a oneOf (dsn xor postgresClusterRef) via CEL
  XValidation. No spec.credentialsSecretRef -- removed entirely in the
  prior redesign commit, not carried forward.
- internal/controller:
  - terdutserver_deployment.go: Deployment + Service via CreateOrUpdate,
    owned (OwnerReference), env built field-for-field against the chart.
  - terdutserver_database.go: both §8 paths. The Zalando path resolves
    the postgresql.acid.zalan.do CR by convention (database/role both
    "terdut", matching every DESIGN.md example) and only ever confirms
    its generated credentials Secret exists -- never reads the value,
    same "wire a secretKeyRef, don't read it" posture the DSN path takes.
    classifyClusterGetError is its own function specifically so the
    CRD-not-installed case (meta.IsNoMatchError) is unit-testable without
    a real client.
  - terdutserver_bootstrap.go: self-registration, checkpointed against
    both real crash windows (DESIGN.md §6 point 1) -- an admin-key
    checkpoint Secret, and adopt-via-GET+mint-new-key on a 409 from
    creating the service account. BootstrapStateLost is its own error
    type so Reconcile can route it to a condition instead of an infinite
    retry.
  - terdutserver_controller.go: ties it together -- finalizer add, DB
    resolution, Deployment/Service reconcile, wait for a ready replica,
    bootstrap, Ready/Bootstrapped/DatabaseReady conditions. Finalizer on
    delete only removes the generated Secrets: terdut-server's API can't
    delete a user or service account, only revoke keys, so there's
    nothing server-side to undo.
- internal/tdclient: added Bootstrap, CreateInstanceServiceAccount,
  GetServiceAccountByName, CreateServiceAccountKey, matching
  terdut-server's real handlers' request/response shapes (internal/api/
  users.go, service_accounts.go in that repo) field-for-field.
- Tests: envtest suite covering the full DSN-path lifecycle end to end
  (finalizer -> Deployment/Service -> simulated readiness -> real
  bootstrap against an httptest.Server fake), the adopt-on-409 recovery
  path, BootstrapStateLost, both Zalando outcomes (cluster not found;
  cluster + Secret found -> real DSN -> Ready), and deletion. A minimal
  test-only stub of the Zalando CRD (internal/controller/testdata) lets
  envtest create fixture objects without a real postgres-operator
  installed. 74.0%/44.7% coverage, 0 lint issues.
- Two things scoped down from §8's full ambition, called out in code and
  ROADMAP.md rather than silently dropped: no live watch on the
  Zalando-generated Secret for rotation (periodic resync notices
  eventually, not immediately), no Gateway API HTTPRoute creation from
  spec.networking (would add a new dependency; nothing about proving
  bootstrap works depends on external ingress existing). Both are
  near-term follow-ups.

Verified locally: make fmt lint test build all clean.

ROADMAP.md

@@ -66,22 +66,35 @@ New commits build forward over the old ones; no git history rewrite.
   once the Deployment has a ready replica, checkpoint the admin key, mint
   the instance-scoped service account, generated credentials Secret in the
   operator's own namespace, `status.credentialsSecretRef`. Finalizer cleans
-  up that Secret and the server-side rows on delete (now actually needed,
-  unlike the superseded version — this stage creates things server-side).
+  up that Secret (and the checkpoint, if one's still there) on delete —
+  there's no server-side row to clean up alongside it: terdut-server's API
+  has no way to delete a user or a service account, only to revoke
+  individual keys, so there's nothing to undo there regardless.
 - RBAC: read-only watch on `postgresql.acid.zalan.do`, degrading gracefully
   if that CRD isn't installed (§8, §9).
+- Shipped, scoped down from §8's full ambition in two ways, both called out
+  in code rather than silently dropped: no live watch on the Zalando-
+  generated credentials Secret for rotation (relies on the periodic resync
+  to notice eventually, higher latency than a watch); no Gateway API
+  `HTTPRoute` creation from `spec.networking.hostname`/`gatewayListener`
+  (needs the Gateway API types as a new dependency, and nothing about
+  proving a `TerdutServer` boots and bootstraps a real server depends on
+  external ingress existing). Both are near-term follow-ups, not deferred
+  to a later stage.
 - `envtest` covering Deployment/Service reconciliation and both database
   paths — the Zalando path needs that CRD's schema vendored into the test
   environment (there's no real `postgres-operator` controller in `envtest`,
   only the CRD shape to create fixture objects against) — plus the
   self-registration flow against an `httptest.Server` fake of
-  `/api/bootstrap` and `/api/service-accounts` (§11), this time exercising
-  the real flow rather than an adopt-only stand-in.
-- A real `kind` end-to-end pass (bring-your-own DSN is simplest there) to
-  prove a `TerdutServer` CR actually produces a running, bootstrapped
-  terdut-server pod. The Zalando path can additionally be validated for
-  real against the org's own cluster later, where `postgres-operator`
-  already runs, rather than only in a disposable `kind` stand-in.
+  `/api/bootstrap` and `/api/service-accounts` (§11), including the
+  adopt-on-409 recovery path and the one fail-closed case
+  (`BootstrapStateLost`), not just the happy path.
+- A real `kind` end-to-end pass is still open (bring-your-own DSN is
+  simplest there) to prove a `TerdutServer` CR actually produces a running,
+  bootstrapped terdut-server pod against a real cluster, not just envtest's
+  fake API server. The Zalando path can additionally be validated for real
+  against the org's own cluster later, where `postgres-operator` already
+  runs, rather than only in a disposable `kind` stand-in.
 
 ## Stage 2 — `TerdutTeam`