Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/controller/secrets.go

@@ -1,49 +0,0 @@
-package controller
-
-import (
-	"context"
-
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	terdutv1alpha1 "git.ryuvia.com/niklas/terdut-operator/api/v1alpha1"
-)
-
-// credentialsSecretDataKey is the fixed data key every generated
-// credentials Secret this controller writes uses — "whatever a human chose"
-// only applied to the bring-your-own input an earlier design draft had and
-// removed (DESIGN.md §6); every Secret any controller in this repo
-// generates itself uses this one key.
-const credentialsSecretDataKey = "token"
-
-// writeOperatorSecret creates or replaces a Secret in namespace (always the
-// operator's own, DESIGN.md §6) holding one raw value under
-// credentialsSecretDataKey. Shared by every controller that generates a
-// credential there -- TerdutServer's instance-scoped key and the bootstrap
-// admin-key checkpoint, TerdutTeam's team-scoped key.
-func writeOperatorSecret(ctx context.Context, c client.Client, namespace, name, rawValue string) error {
-	secret := &corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace},
-		Data:       map[string][]byte{credentialsSecretDataKey: []byte(rawValue)},
-	}
-	if err := c.Create(ctx, secret); err != nil {
-		if apierrors.IsAlreadyExists(err) {
-			return c.Update(ctx, secret)
-		}
-		return err
-	}
-	return nil
-}
-
-// readOperatorSecret reads one generated credential back, by the
-// SecretKeyRef a controller's own status stores (always resolved in the
-// operator's own namespace, never the referencing CR's -- DESIGN.md §6).
-func readOperatorSecret(ctx context.Context, c client.Client, namespace string, ref *terdutv1alpha1.SecretKeyRef) (string, error) {
-	var secret corev1.Secret
-	if err := c.Get(ctx, client.ObjectKey{Namespace: namespace, Name: ref.Name}, &secret); err != nil {
-		return "", err
-	}
-	return string(secret.Data[ref.Key]), nil
-}