Initial cephrgw-operator: Ceph RGW buckets & keys via dashboard API

Adds a Kubernetes operator that provisions Ceph RGW (S3) buckets and
access keys declaratively through the Ceph manager dashboard REST API.

Three CRDs in group ceph.unkin.net/v1alpha1:
- ObjectStoreUser: creates an RGW user, delivers its key pair to a Secret
- Bucket: creates an S3 bucket owned by an ObjectStoreUser; owns the
  bucket's aggregate S3 policy (union of all BucketAccess grants)
- BucketAccess: grants read-only/read-write/full access, provisioning a
  dedicated user (or reusing a referenced one) and delivering RW/RO keys

The internal/ceph client wraps the dashboard /api/auth, /api/rgw/user and
/api/rgw/bucket endpoints with lazy token auth and re-auth on 401. Bucket
policies are rendered deterministically and applied via the bucket
policy API (Reef 18.2+). Credentials come from the cephrgw-credentials
Secret via env. Includes generated CRDs/RBAC, samples, kind manifests,
Woodpecker CI, and docs/ceph-setup.md covering the required Ceph
dashboard account, RGW wiring and permissions.

Makefile

@@ -0,0 +1,57 @@
+.PHONY: build test lint fmt generate manifests docker-operator clean tidy patch minor major
+
+BINARY_OP := bin/cephrgw-operator
+VERSION   ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "0.0.0-dev")
+
+build: tidy
+	go build -ldflags="-s -w" -o $(BINARY_OP) ./cmd/operator
+
+test:
+	go test -race -count=1 ./api/... ./internal/...
+
+lint:
+	go vet ./...
+
+fmt:
+	gofmt -w .
+
+CRD_BUNDLE := config/crd/install.yaml
+
+## generate: regenerate deepcopy, CRDs and RBAC from kubebuilder markers, then
+## bundle every CRD into a single applyable manifest ($(CRD_BUNDLE)) so it can
+## be referenced by a stable raw URL.
+generate:
+	controller-gen object paths="./api/..."
+	controller-gen crd paths="./api/..." output:crd:artifacts:config=config/crd/bases
+	controller-gen rbac:roleName=cephrgw-operator paths="./internal/controller/..." output:rbac:dir=config/rbac
+	printf '# Generated by "make generate". DO NOT EDIT.\n' > $(CRD_BUNDLE)
+	cat config/crd/bases/*.yaml >> $(CRD_BUNDLE)
+
+manifests: generate
+
+docker-operator:
+	docker build -t cephrgw-operator:$(VERSION) -f Dockerfile.operator .
+
+clean:
+	rm -rf bin/
+
+tidy:
+	go mod tidy
+
+_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
+_BASE   := $(if $(_LATEST),$(_LATEST),v0.0.0)
+_MAJ    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
+_MIN    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
+_PAT    := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
+
+patch:
+	@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
+
+minor:
+	@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW
+
+major:
+	@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
+	git tag $$NEW && echo "Tagged $$NEW" && git push origin $$NEW