Stage 3: TerdutEscalationRule + TerdutDeadmanSwitch

Both child CRDs resolve their own teamRef -> TerdutTeam.status via the new
shared resolveTeamAndClient helper (childref.go), never chaining up to
TerdutServer (DESIGN.md §5) -- TerdutTeam.status.serverEndpoint, added in
this same stage, is what makes that literally true.

TerdutEscalationRule: one PUT /api/teams/{id}/escalation per reconcile
(an upsert server-side, confirmed against source), resolving each "user"
target's username to a user_id via GET /api/users first and reporting
Ready: False, reason: UnknownUser if it doesn't resolve. No DELETE exists
for this resource, so its delete path PUTs an empty policy as the closest
available undo.

TerdutDeadmanSwitch: real create/update-in-place/delete, using
terdut-server v0.33.0's PUT (added specifically for this operator). No
unique-name constraint server-side, so idempotent-create here is
GET-list-and-match-by-name rather than adopt-on-409.

Extends tdclient with User/GetUserByUsername, the escalation request types
+ SetEscalation, and DeadmanSwitch + its CRUD methods. Also folds
ConditionTeamReady into the single shared ConditionReady constant, since
both were literally "Ready" and Stage 3 would otherwise have needed a
third same-valued constant.

internal/controller/terdutserver_controller_test.go's fakeTerdutServer
grows GET /api/users, PUT .../escalation, and the full dead man's switch
collection/item routes, replacing the old parseTeamPath/handleTeamByID
pair with a more general parseTeamSubPath/handleTeamSubPath dispatcher
that still covers every existing Stage 1/2 route unchanged.

make fmt lint test build all clean; envtest coverage for
internal/controller: 50.5% -> 71.7%.

internal/controller/terdutteam_controller.go

@@ -95,7 +95,9 @@ func (r *TerdutTeamReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	if err != nil {
 		return ctrl.Result{}, err
 	}
-	instanceClient := newClient(serviceURL(srv)).WithToken(instanceKey)
+	endpoint := serviceURL(srv)
+	team.Status.ServerEndpoint = endpoint
+	instanceClient := newClient(endpoint).WithToken(instanceKey)
 
 	if team.Status.TeamID == 0 {
 		if err := r.createOrAdoptTeam(ctx, &team, instanceClient); err != nil {
@@ -113,7 +115,7 @@ func (r *TerdutTeamReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	if err != nil {
 		return ctrl.Result{}, err
 	}
-	teamClient := newClient(serviceURL(srv)).WithToken(teamKey)
+	teamClient := newClient(endpoint).WithToken(teamKey)
 
 	// Owner-gated on terdut-server, so this always runs with the
 	// team-scoped credential just minted above, never the instance-scoped
@@ -131,7 +133,7 @@ func (r *TerdutTeamReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	}
 
 	meta.SetStatusCondition(&team.Status.Conditions, metav1.Condition{
-		Type:    terdutv1alpha1.ConditionTeamReady,
+		Type:    terdutv1alpha1.ConditionReady,
 		Status:  metav1.ConditionTrue,
 		Reason:  terdutv1alpha1.ReasonTeamAdopted,
 		Message: fmt.Sprintf("team %d ready, credentials in Secret %q", team.Status.TeamID, team.Status.CredentialsSecretRef.Name),
@@ -208,7 +210,7 @@ func (r *TerdutTeamReconciler) setTeamNotReady(
 	ctx context.Context, team *terdutv1alpha1.TerdutTeam, reason, message string, d time.Duration,
 ) (ctrl.Result, error) {
 	meta.SetStatusCondition(&team.Status.Conditions, metav1.Condition{
-		Type:    terdutv1alpha1.ConditionTeamReady,
+		Type:    terdutv1alpha1.ConditionReady,
 		Status:  metav1.ConditionFalse,
 		Reason:  reason,
 		Message: message,