Fix leader-election RBAC, Go version drift, PVC churn, cron names, apply order

Addresses PR review + acceptance findings:

- Add leader-election RBAC: namespaced Role (coordination leases +
  events) and RoleBinding to the operator ServiceAccount, so controllers
  actually start under --leader-elect instead of looping on "leases
  forbidden". Verified in a kind cluster: lease acquired, both
  controllers start workers.
- Align Go versions: bump Dockerfile.operator to golang:1.26-alpine and
  CI images to golang:1.26 to match go.mod (go 1.26.5); set
  GOTOOLCHAIN=local so the image build stays hermetic (no toolchain
  download).
- PVC controller: add an annotation predicate so only PVCs carrying (or
  transitioning off of) backups.unkin.net/schedule enqueue, eliminating
  reconcile churn from unannotated PVCs while keeping the teardown path.
- Cron validator: accept alphabetic month/day-of-week names (MON, JAN,
  MON-FRI) that k8up and CNPG's robfig/cron accept, still rejecting
  unknown names; add unit tests for both mapping paths.
- Deploy ordering: extract the Namespace into its own manifest and add a
  config/kustomization.yaml so `kubectl apply -k config` creates the
  namespace first; document it in the README.
- Note the credential-less push precedent (jellyfin-ha) in docker.yaml.

internal/controller/schedule_test.go

@@ -16,10 +16,13 @@ func TestScheduleForK8up(t *testing.T) {
 		{"0 2 * * *", "0 2 * * *", false},
 		{"*/15 * * * *", "*/15 * * * *", false},
 		{"0 0 * * 1-5", "0 0 * * 1-5", false},
+		{"0 0 1 * MON", "0 0 1 * MON", false},         // alphabetic day-of-week
+		{"0 0 1 JAN *", "0 0 1 JAN *", false},         // alphabetic month
+		{"0 0 * * mon-fri", "0 0 * * mon-fri", false}, // lowercase range of names
 		{"@bogus", "", true},
 		{"0 2 * *", "", true},     // 4 fields
 		{"0 0 0 * * *", "", true}, // 6 fields not valid for k8up
-		{"0 2 * * foo", "", true}, // invalid chars
+		{"0 2 * * foo", "", true}, // unknown alphabetic name
 		{"", "", true},
 	}
 	for _, c := range cases {
@@ -57,10 +60,12 @@ func TestScheduleForCNPG(t *testing.T) {
 		{"*/15 * * * *", "0 */15 * * * *", false},
 		{"30 0 3 * * *", "30 0 3 * * *", false}, // already 6-field
 		{"  @daily ", "0 0 0 * * *", false},
+		{"0 0 1 * MON", "0 0 0 1 * MON", false},   // 5-field w/ alphabetic dow gains seconds
+		{"0 0 0 1 JAN *", "0 0 0 1 JAN *", false}, // 6-field w/ alphabetic month
 		{"@bogus", "", true},
 		{"0 2 * *", "", true},       // 4 fields
 		{"1 2 3 4 5 6 7", "", true}, // 7 fields
-		{"0 2 * * bad", "", true},   // invalid chars
+		{"0 2 * * bad", "", true},   // unknown alphabetic name
 		{"", "", true},
 	}
 	for _, c := range cases {