Initial cephrgw-operator: Ceph RGW buckets & keys via dashboard API

Adds a Kubernetes operator that provisions Ceph RGW (S3) buckets and
access keys declaratively through the Ceph manager dashboard REST API.

Three CRDs in group ceph.unkin.net/v1alpha1:
- ObjectStoreUser: creates an RGW user, delivers its key pair to a Secret
- Bucket: creates an S3 bucket owned by an ObjectStoreUser; owns the
  bucket's aggregate S3 policy (union of all BucketAccess grants)
- BucketAccess: grants read-only/read-write/full access, provisioning a
  dedicated user (or reusing a referenced one) and delivering RW/RO keys

The internal/ceph client wraps the dashboard /api/auth, /api/rgw/user and
/api/rgw/bucket endpoints with lazy token auth and re-auth on 401. Bucket
policies are rendered deterministically and applied via the bucket
policy API (Reef 18.2+). Credentials come from the cephrgw-credentials
Secret via env. Includes generated CRDs/RBAC, samples, kind manifests,
Woodpecker CI, and docs/ceph-setup.md covering the required Ceph
dashboard account, RGW wiring and permissions.

api/v1alpha1/common.go

@@ -0,0 +1,27 @@
+package v1alpha1
+
+// Quota describes an RGW quota applied to a user or a bucket. A nil limit (or a
+// negative value) means unlimited for that dimension.
+type Quota struct {
+	// Enabled turns the quota on. When false the other fields are ignored and
+	// the quota is disabled on the target.
+	// +kubebuilder:default=true
+	// +optional
+	Enabled bool `json:"enabled,omitempty"`
+
+	// MaxSizeBytes caps the total size in bytes. Nil or negative means unlimited.
+	// +optional
+	MaxSizeBytes *int64 `json:"maxSizeBytes,omitempty"`
+
+	// MaxObjects caps the number of objects. Nil or negative means unlimited.
+	// +optional
+	MaxObjects *int64 `json:"maxObjects,omitempty"`
+}
+
+// SecretKeyRef points at a single key within a Secret in the same namespace.
+type SecretKeyRef struct {
+	// Name is the Secret name.
+	Name string `json:"name"`
+	// Key is the data key within the Secret.
+	Key string `json:"key"`
+}