feat: watch owned resources and user-provided TLS secrets for prompt reconciliation

[viniciusdc]

Summary

PR 3 of the routing/SecurityPolicy consolidation (#139). The controller only watched NebariApp (via For) plus cert-manager Certificates, so drift in the resources it manages was only repaired on the periodic requeue (up to ~1 minute). This adds event-driven watches.

Owned resources (closes #30)

• SetupWithManager now Owns HTTPRoute, SecurityPolicy, and Secret, so external edits or deletions of those trigger reconciliation immediately.
• HTTPRoutes and SecurityPolicys already carry controller owner references; the OIDC client Secret did not. storeClientSecret now sets one via controllerutil.SetControllerReference (and adopts pre-existing secrets on the next sync by writing the owner reference on update too).
• KeycloakProvider gains a Scheme field, wired from mgr.GetScheme() in main.go. A nil Scheme skips the owner reference, so existing provider tests that don't wire a scheme keep passing.
• Scheme registration already covers all three types (gatewayapiv1.Install, egv1alpha1.AddToScheme, core), so no scheme changes were needed.

User-provided TLS secrets (closes #115)

• Adds a filtered Watches on Secrets in the Gateway namespace (envoy-gateway-system), mapped back to any NebariApp referencing them via routing.tls.secretName. Creating or fixing a referenced secret now flips TLSReady promptly instead of on the periodic requeue.
• The map function lists NebariApps from the controller cache, so the per-event cost is negligible. The namespace filter lives in the watch predicate; the OIDC client Secret in app namespaces is handled by Owns above, this watch is for the unowned, user-managed secret.

Test plan

• go build ./..., go vet ./..., gofmt -l clean.
• go test ./internal/controller/reconcilers/auth/... passes, including the new TestKeycloakProvider_StoreClientSecret_SetsOwnerReference.
• go test -run TestSecretToNebariApp ./internal/controller/ passes (placed in a standalone test file so it runs without the envtest suite).
• The internal/controller Ginkgo/envtest suite fails locally on a pre-existing scheme-registration gap (also fails on clean main; needs make test's CRD setup) — unrelated to this change.

Notes / follow-ups

• Owns(&corev1.Secret{}) makes the manager cache Secrets in watched namespaces. That is what enhancement: Add watches on owned resources (HTTPRoute, SecurityPolicy, Secret) #30 asks for; if the cluster-wide Secret cache becomes a concern, a label-selector cache is a reasonable later optimization.
• enhancement: Add watches on owned resources (HTTPRoute, SecurityPolicy, Secret) #30's "integration test confirms deleting an owned HTTPRoute triggers re-creation" belongs in the envtest suite, which doesn't run in this environment. Left as a follow-up; the Owns wiring is the standard controller-runtime pattern and the owner-reference unit test covers the piece that was missing (the Secret owner ref).

[github-actions]

Docker Images Built

Images pushed to Quay.io for branch feat-owned-resource-watches:

Image	Tag	Platforms
Operator	quay.io/nebari/nebari-operator:feat-owned-resource-watches	linux/amd64 + linux/arm64

Test the operator:

kubectl apply -k https://github.com/nebari-dev/nebari-operator.git/config/default?ref=feat/owned-resource-watches
kubectl set image deployment/nebari-operator-controller-manager manager=quay.io/nebari/nebari-operator:feat-owned-resource-watches -n nebari-operator-system