Initial cephrgw-operator: Ceph RGW buckets & keys via dashboard API

Adds a Kubernetes operator that provisions Ceph RGW (S3) buckets and
access keys declaratively through the Ceph manager dashboard REST API.

Three CRDs in group ceph.unkin.net/v1alpha1:
- ObjectStoreUser: creates an RGW user, delivers its key pair to a Secret
- Bucket: creates an S3 bucket owned by an ObjectStoreUser; owns the
  bucket's aggregate S3 policy (union of all BucketAccess grants)
- BucketAccess: grants read-only/read-write/full access, provisioning a
  dedicated user (or reusing a referenced one) and delivering RW/RO keys

The internal/ceph client wraps the dashboard /api/auth, /api/rgw/user and
/api/rgw/bucket endpoints with lazy token auth and re-auth on 401. Bucket
policies are rendered deterministically and applied via the bucket
policy API (Reef 18.2+). Credentials come from the cephrgw-credentials
Secret via env. Includes generated CRDs/RBAC, samples, kind manifests,
Woodpecker CI, and docs/ceph-setup.md covering the required Ceph
dashboard account, RGW wiring and permissions.

config/samples/03-access-readwrite.yaml

@@ -0,0 +1,34 @@
+# Read-write credentials for the bucket, delivered to a dedicated user and
+# Secret "app-data-rw-rgw". The owner (app-owner) always retains full control;
+# this grant is for a separate workload that needs to read and write objects
+# but must not manage the bucket itself.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: BucketAccess
+metadata:
+  name: app-data-rw
+  namespace: default
+spec:
+  bucketRef: app-data
+  level: read-write
+  secretName: app-data-rw-rgw
+---
+# Alternatively, grant an *existing* ObjectStoreUser access to the bucket by
+# name. Here no user or Secret is created; the shared user's own credential
+# Secret is used, and the bucket policy is extended to include it.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: analytics
+  namespace: default
+spec:
+  displayName: "Analytics pipeline"
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: BucketAccess
+metadata:
+  name: app-data-analytics
+  namespace: default
+spec:
+  bucketRef: app-data
+  level: read-only
+  userRef: analytics