Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch

Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.

TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.

TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.

Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.

internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.

make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.

config/rbac/role.yaml

@@ -55,6 +55,8 @@ rules:
 - apiGroups:
   - terdut.ryuvia.com
   resources:
+  - terdutdeadmanswitches
+  - terdutescalationrules
   - terdutservers
   - terdutteams
   verbs:
@@ -68,6 +70,8 @@ rules:
 - apiGroups:
   - terdut.ryuvia.com
   resources:
+  - terdutdeadmanswitches/finalizers
+  - terdutescalationrules/finalizers
   - terdutservers/finalizers
   - terdutteams/finalizers
   verbs:
@@ -75,6 +79,8 @@ rules:
 - apiGroups:
   - terdut.ryuvia.com
   resources:
+  - terdutdeadmanswitches/status
+  - terdutescalationrules/status
   - terdutservers/status
   - terdutteams/status
   verbs: