Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

examples/demo/fire-alerts.sh

@@ -44,7 +44,7 @@ scenarios:
   disk-full   critical -- disk usage above 95%
   pod-crash   error    -- a pod crash-looping
   heartbeat   critical -- the team's dead man's switch heartbeat
-              (matches the matcher in 06/07-deadman-*.yaml -- send this
+              (matches the matcher in the deadmanSwitches in 02/03-team-*.yaml -- send this
               repeatedly to keep the switch alive, or stop sending it and
               watch terdut-server open an incident on its own once
               `timeout` passes with no heartbeat. "resolve" is not a valid
@@ -74,7 +74,7 @@ case "$scenario" in
   disk-full) alertname=TerdutDemoDiskFull        severity=critical summary="Disk usage above 95% on /data" ;;
   pod-crash) alertname=TerdutDemoPodCrashLooping severity=error    summary="Pod web-7f8b9 is crash-looping (5 restarts in 10m)" ;;
   heartbeat)
-    # Must match 06-deadman-platform.yaml / 07-deadman-payments.yaml's own
+    # Must match 02-team-platform.yaml / 03-team-payments.yaml's own
     # matcher exactly -- that's what makes this a heartbeat rather than a
     # third ordinary alert.
     case "$team" in
@@ -95,7 +95,7 @@ esac
 
 secret_name="terdutalertsource-${team}-terdut-webhook"
 key="$(kubectl -n "$NAMESPACE" get secret "$secret_name" -o jsonpath='{.data.key}' | base64 -d)"
-[ -n "$key" ] || { echo "fire-alerts.sh: empty key read from Secret $secret_name -- has 08/09-alertsource-*.yaml reconciled yet?" >&2; exit 1; }
+[ -n "$key" ] || { echo "fire-alerts.sh: empty key read from Secret $secret_name -- has 04/05-alertsource-*.yaml reconciled yet?" >&2; exit 1; }
 
 # Stable per (team, scenario) so a resolve targets the same alert a fire
 # created: terdut-server correlates on (team_id, fingerprint), not on