Stage 1: TerdutServer full lifecycle (Deployment, Service, both database

paths, self-registration bootstrap)

Replaces the bring-your-own-only Stage 1 (commit 1be7cf2) wholesale, per
the redesign in the previous two commits: the operator creates every
server it manages, so self-registration (DESIGN.md §6) is the only
bootstrap path, and Deployment/Service/database management builds
together with it (ROADMAP.md Stage 1) rather than behind a separate
later stage.

Grounded in terdut-server's actual chart (charts/terdut-server/templates/
deployment.yaml, values.yaml), not reconstructed from DESIGN.md's
illustrative YAML alone -- env var names, the password-via-PGPASSWORD
convention, the Recreate deployment strategy, /healthz probes, and the
TERDUT_OPERATOR_MODE=true decision (always on here, unlike the chart's
default-off: every write this operator's own future controllers make
goes through a service account already) all match that source exactly.

- api/v1alpha1: full TerdutServerSpec (image, replicas, networking,
  database, sweeper, deadman, notify, oidc, passwordLogin, allowedTeams).
  spec.database is a oneOf (dsn xor postgresClusterRef) via CEL
  XValidation. No spec.credentialsSecretRef -- removed entirely in the
  prior redesign commit, not carried forward.
- internal/controller:
  - terdutserver_deployment.go: Deployment + Service via CreateOrUpdate,
    owned (OwnerReference), env built field-for-field against the chart.
  - terdutserver_database.go: both §8 paths. The Zalando path resolves
    the postgresql.acid.zalan.do CR by convention (database/role both
    "terdut", matching every DESIGN.md example) and only ever confirms
    its generated credentials Secret exists -- never reads the value,
    same "wire a secretKeyRef, don't read it" posture the DSN path takes.
    classifyClusterGetError is its own function specifically so the
    CRD-not-installed case (meta.IsNoMatchError) is unit-testable without
    a real client.
  - terdutserver_bootstrap.go: self-registration, checkpointed against
    both real crash windows (DESIGN.md §6 point 1) -- an admin-key
    checkpoint Secret, and adopt-via-GET+mint-new-key on a 409 from
    creating the service account. BootstrapStateLost is its own error
    type so Reconcile can route it to a condition instead of an infinite
    retry.
  - terdutserver_controller.go: ties it together -- finalizer add, DB
    resolution, Deployment/Service reconcile, wait for a ready replica,
    bootstrap, Ready/Bootstrapped/DatabaseReady conditions. Finalizer on
    delete only removes the generated Secrets: terdut-server's API can't
    delete a user or service account, only revoke keys, so there's
    nothing server-side to undo.
- internal/tdclient: added Bootstrap, CreateInstanceServiceAccount,
  GetServiceAccountByName, CreateServiceAccountKey, matching
  terdut-server's real handlers' request/response shapes (internal/api/
  users.go, service_accounts.go in that repo) field-for-field.
- Tests: envtest suite covering the full DSN-path lifecycle end to end
  (finalizer -> Deployment/Service -> simulated readiness -> real
  bootstrap against an httptest.Server fake), the adopt-on-409 recovery
  path, BootstrapStateLost, both Zalando outcomes (cluster not found;
  cluster + Secret found -> real DSN -> Ready), and deletion. A minimal
  test-only stub of the Zalando CRD (internal/controller/testdata) lets
  envtest create fixture objects without a real postgres-operator
  installed. 74.0%/44.7% coverage, 0 lint issues.
- Two things scoped down from §8's full ambition, called out in code and
  ROADMAP.md rather than silently dropped: no live watch on the
  Zalando-generated Secret for rotation (periodic resync notices
  eventually, not immediately), no Gateway API HTTPRoute creation from
  spec.networking (would add a new dependency; nothing about proving
  bootstrap works depends on external ingress existing). Both are
  near-term follow-ups.

Verified locally: make fmt lint test build all clean.

config/samples/terdut_v1alpha1_terdutserver.yaml

@@ -6,18 +6,28 @@ metadata:
     app.kubernetes.io/managed-by: kustomize
   name: terdutserver-sample
 spec:
-  # An already-running terdut-server this TerdutServer represents — Stage 1
-  # never creates or manages a Deployment/Service for it (ROADMAP.md).
-  endpoint: "http://terdut.oncall.svc.cluster.local:8080"
-  # Bring-your-own instance credential (DESIGN.md §6): mint this once,
-  # manually, with your own admin session --
-  #   curl -H "Authorization: Bearer <your-own-api-key>" \
-  #        -X POST "$ENDPOINT/api/service-accounts" \
-  #        -d '{"name":"terdut-operator","scope":"instance"}'
-  # -- then create this Secret, in the OPERATOR's own namespace, from the
-  # "key" field of that response:
-  #   kubectl create secret generic terdutserver-sample-creds \
-  #     -n <operator namespace> --from-literal=token=<the key>
-  credentialsSecretRef:
-    name: terdutserver-sample-creds
-    key: token
+  image:
+    repository: git.ryuvia.com/niklas/terdut-server
+    tag: v0.20.0
+  replicas: 1
+  networking:
+    hostname: terdut.example.com
+    servicePort: 8080
+  # Bring-your-own DSN (simplest path, no external CRD dependency). For the
+  # Zalando postgres-operator path instead, use:
+  #   database:
+  #     postgresClusterRef:
+  #       name: terdut-postgres
+  database:
+    dsn: "postgres://terdut@terdut-postgres:5432/terdut?sslmode=require"
+    passwordSecretRef:
+      name: terdut-postgres-password
+      key: password
+  sweeper:
+    staleAfter: 6h
+    archiveAfter: 168h
+  deadman:
+    matchers: "alertname=Watchdog"
+    timeout: 15m
+    severity: critical
+  passwordLogin: true