Implement autobackup-operator controllers, tests, CI and packaging

PVCs and CloudNativePG Clusters need S3 buckets and backup schedules
provisioned consistently. This operator watches the
backups.unkin.net/{schedule,destination} annotations on those objects and
provisions everything needed to back them up, with no new CRDs.

- Add a PVC controller that provisions cephrgw ObjectStoreUser/Bucket/BucketAccess,
  auto-generates a restic repo-password Secret and creates a k8up Schedule scoped
  to the PVC via spec.backup.volumes[].persistentVolumeClaim.claimName.
- Add a CNPG Cluster controller that provisions the same bucket stack, idempotently
  patches spec.backup.barmanObjectStore (leaving a user-set destinationPath alone
  with a Warning event) and creates a ScheduledBackup.
- Resolve destinations through a ConfigMap lookup table; requeue until the
  BucketAccess is Ready before creating schedule resources; own-reference created
  resources and retain bucket data by default.
- Add schedule-mapping helpers (k8up 5-field/shortcut pass-through, CNPG 6-field
  seconds-first) and deterministic, length-bounded name derivation.
- Add unit tests (schedule mapping, name derivation, destination resolution) and
  envtest controller tests for both paths, wiring the external CRDs into envtest.
- Add kubebuilder-generated RBAC, a Dockerfile (distroless/nonroot), Woodpecker
  lint/test/build pipelines and a tag-triggered image push to the artifactapi
  docker-internal registry, plus a version-bump Makefile and deploy manifests.

internal/controller/destinations.go

@@ -0,0 +1,51 @@
+package controller
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/yaml"
+)
+
+// Destination is a resolved backup target parsed from the operator's
+// destinations ConfigMap.
+type Destination struct {
+	PlacementTarget  string `json:"placementTarget,omitempty"`
+	Zonegroup        string `json:"zonegroup,omitempty"`
+	Endpoint         string `json:"endpoint,omitempty"`
+	EndpointCASecret string `json:"endpointCASecret,omitempty"`
+	EndpointCAKey    string `json:"endpointCAKey,omitempty"`
+}
+
+// errDestinationNotFound signals a missing ConfigMap or entry so callers can
+// emit a Warning event and requeue instead of treating it as a hard failure.
+var errDestinationNotFound = errors.New("destination not found")
+
+// resolveDestination looks a logical destination name up in the operator's
+// destinations ConfigMap and parses its YAML entry.
+func resolveDestination(ctx context.Context, c client.Client, ns, cmName, dest string) (Destination, error) {
+	var cm corev1.ConfigMap
+	if err := c.Get(ctx, types.NamespacedName{Namespace: ns, Name: cmName}, &cm); err != nil {
+		if apierrors.IsNotFound(err) {
+			return Destination{}, fmt.Errorf("destinations ConfigMap %s/%s: %w", ns, cmName, errDestinationNotFound)
+		}
+		return Destination{}, err
+	}
+	raw, ok := cm.Data[dest]
+	if !ok {
+		return Destination{}, fmt.Errorf("destination %q: %w", dest, errDestinationNotFound)
+	}
+	var d Destination
+	if err := yaml.Unmarshal([]byte(raw), &d); err != nil {
+		return Destination{}, fmt.Errorf("destination %q: %w", dest, err)
+	}
+	if d.Endpoint == "" {
+		return Destination{}, fmt.Errorf("destination %q: missing endpoint", dest)
+	}
+	return d, nil
+}