Reflect externaldns TSIG key into the externaldns namespace (#285)

## Why

Step 1 of 3 in the external-dns → in-cluster bind migration. For external-dns to send RFC2136 updates to the in-cluster `bind-externaldns` primary, it must present the exact TSIG key the primary's `allow-update` accepts. The bind-operator generates that key material into Secret `externaldns-key-tsig` in `bind-internal`; reflecting it into the `externaldns` namespace removes the manual eyaml→Vault key sync and guarantees key parity.

## Changes

- Adds `spec.secretTemplate.annotations` to BindTSIGKey `externaldns-key` with the emberstack reflector hints: `reflection-allowed`, `reflection-allowed-namespaces: externaldns`, `reflection-auto-enabled`, `reflection-auto-namespaces: externaldns`.
- Regenerates `schemas/bind.unkin.net/bindtsigkey_v1alpha1.json` from the live CRD (deployed bind-operator v0.2.4 already exposes `secretTemplate` — the WIP branch's ">= v0.3.0" claim is stale) to add the `secretTemplate` property. Schema output is byte-identical to running `ci/generate-schemas.sh`.

`kubectl kustomize apps/overlays/au-syd1/bind-internal` builds clean and renders the annotations onto the BindTSIGKey.

## Verification (after merge)

```
kubectl -n externaldns get secret externaldns-key-tsig \
  -o jsonpath='{.data.secret} {.data.algorithm}{"\n"}'
```
Both `secret` and `algorithm` keys must be present (reflector mirrored the source Secret from bind-internal).

## Rollback

Revert this PR. The source Secret in bind-internal is unaffected; only the reflected mirror in `externaldns` is removed.

Merge order: this is PR 1/3. PR 2 (repoint external-dns) must not merge until the reflected secret is verified.

Reviewed-on: #285
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

apps/base/bind-internal/externaldns/tsigkey.yaml

@@ -1,6 +1,10 @@
 ---
 # Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
+# updates to the primary. The operator generates the material into a Secret
+# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
+# reflector hints onto that Secret so it is mirrored into the externaldns
+# namespace, where the external-dns controller reads it -- guaranteeing
+# external-dns presents exactly the key the primary's allow-update accepts.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
@@ -9,3 +13,9 @@ metadata:
 spec:
   clusterRef: bind-externaldns
   algorithm: hmac-sha256
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"

schemas/bind.unkin.net/bindtsigkey_v1alpha1.json

@@ -35,6 +35,23 @@
         },
         "secretName": {
           "type": "string"
+        },
+        "secretTemplate": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "labels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"