Implement autobackup-operator controllers, tests, CI and packaging

PVCs and CloudNativePG Clusters need S3 buckets and backup schedules
provisioned consistently. This operator watches the
backups.unkin.net/{schedule,destination} annotations on those objects and
provisions everything needed to back them up, with no new CRDs.

- Add a PVC controller that provisions cephrgw ObjectStoreUser/Bucket/BucketAccess,
  auto-generates a restic repo-password Secret and creates a k8up Schedule scoped
  to the PVC via spec.backup.volumes[].persistentVolumeClaim.claimName.
- Add a CNPG Cluster controller that provisions the same bucket stack, idempotently
  patches spec.backup.barmanObjectStore (leaving a user-set destinationPath alone
  with a Warning event) and creates a ScheduledBackup.
- Resolve destinations through a ConfigMap lookup table; requeue until the
  BucketAccess is Ready before creating schedule resources; own-reference created
  resources and retain bucket data by default.
- Add schedule-mapping helpers (k8up 5-field/shortcut pass-through, CNPG 6-field
  seconds-first) and deterministic, length-bounded name derivation.
- Add unit tests (schedule mapping, name derivation, destination resolution) and
  envtest controller tests for both paths, wiring the external CRDs into envtest.
- Add kubebuilder-generated RBAC, a Dockerfile (distroless/nonroot), Woodpecker
  lint/test/build pipelines and a tag-triggered image push to the artifactapi
  docker-internal registry, plus a version-bump Makefile and deploy manifests.

README.md

@@ -1,3 +1,66 @@
 # autobackup-operator
 
-Kubernetes operator that provisions S3 buckets and backup schedules from backups.unkin.net/* annotations on PVCs and CNPG clusters
+A Kubernetes operator that watches for `backups.unkin.net/*` annotations on
+**PersistentVolumeClaims** and **CloudNativePG Clusters** and provisions the S3
+bucket + backup-schedule resources needed to back them up. No new CRDs — it is
+purely annotation-driven on existing objects.
+
+## Annotations
+
+| Annotation | Meaning |
+|---|---|
+| `backups.unkin.net/schedule` | `@hourly` / `@daily` / `@weekly` (plus `@monthly`/`@yearly`) or a raw cron expression. Absence means "not managed". |
+| `backups.unkin.net/destination` | A logical destination name resolved via the destinations ConfigMap. |
+| `backups.unkin.net/purge-on-delete` | `"true"` opts into deleting the bucket stack when the schedule annotation is removed (default: retain bucket data). |
+
+## What it does
+
+For every annotated object the operator, in the object's own namespace and
+owner-referenced to it:
+
+1. Provisions a cephrgw (`ceph.unkin.net/v1alpha1`) `ObjectStoreUser`, `Bucket`
+   (`versioning: true`, `retainOnDelete: true`) and read-write `BucketAccess`.
+2. Waits for the `BucketAccess` to become `Ready` (requeues until then).
+3. Then wires up the backup schedule:
+   - **PVC → k8up** (`k8up.io/v1` `Schedule`): S3 backend from the cephrgw
+     credential Secret, an auto-generated restic repo-password Secret, and the
+     backup scoped to exactly this PVC via
+     `spec.backup.volumes[].persistentVolumeClaim.claimName`. Sane prune
+     retention (keepDaily 7, keepWeekly 4).
+   - **CNPG Cluster** (`postgresql.cnpg.io/v1`): patches
+     `spec.backup.barmanObjectStore` (idempotently; a user-set different
+     `destinationPath` is left untouched with a Warning event) and creates a
+     `ScheduledBackup` with a 6-field (seconds-first) cron.
+
+## Destinations ConfigMap
+
+The operator resolves `destination` names against a ConfigMap in its own
+namespace (`autobackup-operator/autobackup-destinations` by default). See
+`config/samples/destinations.yaml`.
+
+## Schedule mapping
+
+- **k8up** accepts cron nicknames natively and 5-field cron expressions; the
+  value is validated and passed through.
+- **CNPG** requires a 6-field (seconds-first) cron: nicknames are expanded and a
+  5-field cron gains a leading `0` seconds field.
+
+Invalid schedules surface as Warning events on the annotated object.
+
+## Development
+
+```sh
+make build      # build the operator binary
+make test       # unit + envtest controller tests (fetches envtest binaries)
+make lint       # go vet
+make generate   # regenerate config/rbac/role.yaml from kubebuilder markers
+```
+
+Dependencies are vendored so the container build and CI need no access to the
+private `cephrgw-operator` module.
+
+## Release
+
+`make patch|minor|major` tags and pushes `vX.Y.Z`. A `v*` tag triggers the
+Woodpecker `docker` pipeline, which builds and pushes
+`artifactapi.k8s.syd1.au.unkin.net/docker-internal/autobackup-operator:<tag>`.