Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/controller/testhelpers_test.go

@@ -8,6 +8,7 @@ import (
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -47,21 +48,15 @@ const (
 	testOperatorNamespace = "default"
 )
 
-// bootstrapReadyTerdutServer creates a TerdutServer with a bring-your-own
-// DSN and drives it to Ready against fakeURL, the same three-pass sequence
-// terdutserver_controller_test.go's own happy-path test exercises directly
-// -- shared here so TerdutTeam's tests (which need a real, Ready
-// TerdutServer to resolve against) don't duplicate it.
-func bootstrapReadyTerdutServer(ctx context.Context, name, fakeURL string) *terdutv1alpha1.TerdutServer {
+// readyTerdutServer creates a TerdutServer with a bring-your-own DSN and drives
+// it to Ready the way the happy-path test does -- shared so the tests of
+// everything that references a server (TerdutTeam, TerdutAlertSource) start
+// from a real, Ready one.
+func readyTerdutServer(ctx context.Context, name string) *terdutv1alpha1.TerdutServer {
 	GinkgoHelper()
 	namespace := testOperatorNamespace
 
-	reconciler := &TerdutServerReconciler{
-		Client:            k8sClient,
-		Scheme:            k8sClient.Scheme(),
-		OperatorNamespace: namespace,
-		NewClient:         func(string) *tdclient.Client { return tdclient.New(fakeURL) },
-	}
+	reconciler := &TerdutServerReconciler{Client: k8sClient, Scheme: k8sClient.Scheme()}
 	objKey := types.NamespacedName{Name: name, Namespace: namespace}
 
 	srv := &terdutv1alpha1.TerdutServer{
@@ -74,9 +69,7 @@ func bootstrapReadyTerdutServer(ctx context.Context, name, fakeURL string) *terd
 	}
 	Expect(k8sClient.Create(ctx, srv)).To(Succeed())
 
-	_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // finalizer
-	Expect(err).NotTo(HaveOccurred())
-	_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // Deployment/Service
+	_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // Deployment, Service, key
 	Expect(err).NotTo(HaveOccurred())
 
 	var deploy appsv1.Deployment
@@ -85,27 +78,25 @@ func bootstrapReadyTerdutServer(ctx context.Context, name, fakeURL string) *terd
 	deploy.Status.Replicas = 1
 	Expect(k8sClient.Status().Update(ctx, &deploy)).To(Succeed())
 
-	_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // bootstrap
+	_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // Ready
 	Expect(err).NotTo(HaveOccurred())
 
 	Expect(k8sClient.Get(ctx, objKey, srv)).To(Succeed())
-	Expect(srv.Status.CredentialsSecretRef).NotTo(BeNil(), "test setup: TerdutServer %s/%s did not reach Bootstrapped", namespace, name)
+	Expect(meta.IsStatusConditionTrue(srv.Status.Conditions, terdutv1alpha1.ConditionReady)).To(BeTrue(),
+		"test setup: TerdutServer %s/%s did not reach Ready", namespace, name)
 	return srv
 }
 
 // readyTerdutTeam creates a TerdutTeam under srv (an already-Ready
-// TerdutServer, e.g. from bootstrapReadyTerdutServer) and drives it to
-// Ready against fakeURL -- shared by TerdutEscalationRule's and
-// TerdutDeadmanSwitch's own tests, which both just need a resolvable
-// teamRef (DESIGN.md §5), not TerdutTeam's own behavior.
+// TerdutServer, from readyTerdutServer) and drives it to Ready against the fake
+// at fakeURL.
 func readyTerdutTeam(ctx context.Context, namespace, name string, srv *terdutv1alpha1.TerdutServer, fakeURL string) *terdutv1alpha1.TerdutTeam {
 	GinkgoHelper()
 
 	reconciler := &TerdutTeamReconciler{
-		Client:            k8sClient,
-		Scheme:            k8sClient.Scheme(),
-		OperatorNamespace: namespace,
-		NewClient:         func(string) *tdclient.Client { return tdclient.New(fakeURL) },
+		Client:    k8sClient,
+		Scheme:    k8sClient.Scheme(),
+		NewClient: func(string) *tdclient.Client { return tdclient.New(fakeURL) },
 	}
 	objKey := types.NamespacedName{Name: name, Namespace: namespace}
 
@@ -120,11 +111,11 @@ func readyTerdutTeam(ctx context.Context, namespace, name string, srv *terdutv1a
 
 	_, err := reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // finalizer
 	Expect(err).NotTo(HaveOccurred())
-	_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // create+mint+apply
+	_, err = reconciler.Reconcile(ctx, reconcile.Request{NamespacedName: objKey}) // apply
 	Expect(err).NotTo(HaveOccurred())
 
 	Expect(k8sClient.Get(ctx, objKey, team)).To(Succeed())
-	Expect(team.Status.CredentialsSecretRef).NotTo(BeNil(), "test setup: TerdutTeam %s/%s did not reach Ready", namespace, name)
+	Expect(team.Status.TeamID).NotTo(BeZero(), "test setup: TerdutTeam %s/%s did not reach Ready", namespace, name)
 	return team
 }