Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/controller/terdutalertsource_controller_test.go

@@ -34,14 +34,13 @@ var _ = Describe("TerdutAlertSource Controller", func() {
 		fake, fakeSrv = newFakeTerdutServer()
 		DeferCleanup(fakeSrv.Close)
 
-		srv = bootstrapReadyTerdutServer(ctx, uniqueName("asserver"), fakeSrv.URL)
+		srv = readyTerdutServer(ctx, uniqueName("asserver"))
 		team = readyTerdutTeam(ctx, operatorNamespace, uniqueName("asteam"), srv, fakeSrv.URL)
 
 		reconciler = &TerdutAlertSourceReconciler{
-			Client:            k8sClient,
-			Scheme:            k8sClient.Scheme(),
-			OperatorNamespace: operatorNamespace,
-			NewClient:         func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) },
+			Client:    k8sClient,
+			Scheme:    k8sClient.Scheme(),
+			NewClient: func(string) *tdclient.Client { return tdclient.New(fakeSrv.URL) },
 		}
 		srcName = uniqueName("alertsource")
 		srcKey = types.NamespacedName{Name: srcName, Namespace: operatorNamespace}