Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/controller/childref.go

@@ -5,14 +5,15 @@ import (
 	"fmt"
 
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/api/meta"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
 	"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
 )
 
-// childError carries a condition reason/message, the same role teamError
-// and databaseError play for their own controllers: an expected,
+// childError carries a condition reason/message, the same role teamError and
+// databaseError play for their own controllers: an expected,
 // requeue-and-retry outcome, not a reconcile failure.
 type childError struct {
 	reason  string
@@ -21,12 +22,13 @@ type childError struct {
 
 func (e *childError) Error() string { return e.message }
 
-// resolveTeamAndClient implements DESIGN.md §5's "every child resolves its
-// own teamRef -> TerdutTeam.status, never chains up to TerdutServer"
-// rule -- shared by TerdutEscalationRule and TerdutDeadmanSwitch, which
-// both need exactly this and nothing else to call terdut-server's API.
+// resolveTeamAndClient finds the TerdutTeam a child (TerdutAlertSource) names,
+// requires it to be Ready, and returns a client for its server authenticated
+// with that server's operator key. The server is read from the team's own
+// serverRef: consent was already checked when the team went Ready, and does not
+// gate a resource the team owns.
 func resolveTeamAndClient(
-	ctx context.Context, c client.Client, operatorNamespace, namespace string,
+	ctx context.Context, c client.Client, namespace string,
 	ref terdutv1alpha1.TerdutTeamRef, newClient func(string) *tdclient.Client,
 ) (*terdutv1alpha1.TerdutTeam, *tdclient.Client, *childError) {
 	var team terdutv1alpha1.TerdutTeam
@@ -39,16 +41,24 @@ func resolveTeamAndClient(
 		}
 		return nil, nil, &childError{reason: terdutv1alpha1.ReasonTeamRefNotFound, message: err.Error()}
 	}
-	if team.Status.CredentialsSecretRef == nil || team.Status.TeamID == 0 {
+	if team.Status.TeamID == 0 || !meta.IsStatusConditionTrue(team.Status.Conditions, terdutv1alpha1.ConditionReady) {
 		return nil, nil, &childError{
 			reason:  terdutv1alpha1.ReasonWaitingForTeam,
 			message: fmt.Sprintf("TerdutTeam %q is not Ready yet", ref.Name),
 		}
 	}
 
-	teamKey, err := readOperatorSecret(ctx, c, operatorNamespace, team.Status.CredentialsSecretRef)
+	srvNS := team.Spec.ServerRef.Namespace
+	if srvNS == "" {
+		srvNS = team.Namespace
+	}
+	var srv terdutv1alpha1.TerdutServer
+	if err := c.Get(ctx, client.ObjectKey{Namespace: srvNS, Name: team.Spec.ServerRef.Name}, &srv); err != nil {
+		return nil, nil, &childError{reason: terdutv1alpha1.ReasonWaitingForTeam, message: err.Error()}
+	}
+	key, err := readOperatorKey(ctx, c, &srv)
 	if err != nil {
 		return nil, nil, &childError{reason: terdutv1alpha1.ReasonWaitingForTeam, message: err.Error()}
 	}
-	return &team, newClient(team.Status.ServerEndpoint).WithToken(teamKey), nil
+	return &team, newClient(serviceURL(&srv)).WithToken(key), nil
 }