Fix leader-election RBAC, Go version drift, PVC churn, cron names, apply order

Addresses PR review + acceptance findings:

- Add leader-election RBAC: namespaced Role (coordination leases +
  events) and RoleBinding to the operator ServiceAccount, so controllers
  actually start under --leader-elect instead of looping on "leases
  forbidden". Verified in a kind cluster: lease acquired, both
  controllers start workers.
- Align Go versions: bump Dockerfile.operator to golang:1.26-alpine and
  CI images to golang:1.26 to match go.mod (go 1.26.5); set
  GOTOOLCHAIN=local so the image build stays hermetic (no toolchain
  download).
- PVC controller: add an annotation predicate so only PVCs carrying (or
  transitioning off of) backups.unkin.net/schedule enqueue, eliminating
  reconcile churn from unannotated PVCs while keeping the teardown path.
- Cron validator: accept alphabetic month/day-of-week names (MON, JAN,
  MON-FRI) that k8up and CNPG's robfig/cron accept, still rejecting
  unknown names; add unit tests for both mapping paths.
- Deploy ordering: extract the Namespace into its own manifest and add a
  config/kustomization.yaml so `kubectl apply -k config` creates the
  namespace first; document it in the README.
- Note the credential-less push precedent (jellyfin-ha) in docker.yaml.

internal/controller/pvc_controller_test.go

@@ -13,9 +13,42 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/tools/record"
+	"sigs.k8s.io/controller-runtime/pkg/event"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 )
 
+func pvcWith(ann map[string]string) *corev1.PersistentVolumeClaim {
+	return &corev1.PersistentVolumeClaim{ObjectMeta: metav1.ObjectMeta{Name: "data", Namespace: "ns", Annotations: ann}}
+}
+
+func TestSchedulePredicate(t *testing.T) {
+	annotated := pvcWith(map[string]string{annSchedule: "@daily"})
+	plain := pvcWith(nil)
+
+	if schedulePredicate.Create(event.CreateEvent{Object: plain}) {
+		t.Error("create of unannotated PVC should be filtered out")
+	}
+	if !schedulePredicate.Create(event.CreateEvent{Object: annotated}) {
+		t.Error("create of annotated PVC should enqueue")
+	}
+	if schedulePredicate.Generic(event.GenericEvent{Object: plain}) {
+		t.Error("generic event for unannotated PVC should be filtered out")
+	}
+	// Annotation removed: old had it, new does not -> must still enqueue so
+	// teardown runs.
+	if !schedulePredicate.Update(event.UpdateEvent{ObjectOld: annotated, ObjectNew: plain}) {
+		t.Error("annotation removal should enqueue for teardown")
+	}
+	// Annotation added.
+	if !schedulePredicate.Update(event.UpdateEvent{ObjectOld: plain, ObjectNew: annotated}) {
+		t.Error("annotation addition should enqueue")
+	}
+	// Neither old nor new annotated -> no enqueue.
+	if schedulePredicate.Update(event.UpdateEvent{ObjectOld: plain, ObjectNew: plain}) {
+		t.Error("update of unannotated PVC should be filtered out")
+	}
+}
+
 func TestPVCReconcile(t *testing.T) {
 	requireEnvtest(t)
 	ctx := context.Background()