Reflect externaldns TSIG key into the externaldns namespace

The external-dns → in-cluster bind migration needs external-dns to present
the exact TSIG key that the in-cluster bind-externaldns primary accepts on
allow-update. The operator generates that key into Secret externaldns-key-tsig
in bind-internal; reflecting it removes the manual eyaml→Vault key sync.

- Add spec.secretTemplate.annotations to BindTSIGKey externaldns-key with the
  emberstack reflector hints (reflection-allowed, allowed/auto-namespaces
  externaldns, auto-enabled) so the operator stamps them onto the managed Secret.
- Regenerate schemas/bind.unkin.net/bindtsigkey_v1alpha1.json from the live CRD
  (deployed bind-operator v0.2.4 already exposes secretTemplate) to add the
  secretTemplate property.

apps/base/bind-internal/externaldns/tsigkey.yaml

@@ -1,6 +1,10 @@
 ---
 # Key that external-dns (and DNSRecord objects) use to send RFC2136 dynamic
-# updates to the primary. The operator generates the material into a Secret.
+# updates to the primary. The operator generates the material into a Secret
+# (externaldns-key-tsig) in this namespace. secretTemplate stamps emberstack
+# reflector hints onto that Secret so it is mirrored into the externaldns
+# namespace, where the external-dns controller reads it -- guaranteeing
+# external-dns presents exactly the key the primary's allow-update accepts.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
@@ -9,3 +13,9 @@ metadata:
 spec:
   clusterRef: bind-externaldns
   algorithm: hmac-sha256
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"

schemas/bind.unkin.net/bindtsigkey_v1alpha1.json

@@ -35,6 +35,23 @@
         },
         "secretName": {
           "type": "string"
+        },
+        "secretTemplate": {
+          "properties": {
+            "annotations": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            "labels": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            }
+          },
+          "type": "object"
         }
       },
       "type": "object"