Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch

Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.

TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.

TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.

Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.

internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.

make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.

config/crd/bases/terdut.ryuvia.com_terdutteams.yaml

@@ -171,6 +171,13 @@ spec:
               observedGeneration:
                 format: int64
                 type: integer
+              serverEndpoint:
+                description: |-
+                  serverEndpoint is the resolved TerdutServer's base URL, resolved once
+                  here so no child controller (TerdutEscalationRule, TerdutDeadmanSwitch,
+                  TerdutAlertSource) ever needs its own RBAC on terdutservers just to
+                  find out where to send a request (DESIGN.md §5).
+                type: string
               teamID:
                 description: |-
                   teamID is the server-side id -- needed by every child object's