Point HA peer URLs at per-pod ClusterIP Services

## Why
kea-dhcp4 crash-loops at HA hook load: kea 2.6's HA hook parses each peer url host as an IP literal and never resolves DNS, so the StatefulSet headless hostnames are rejected ("Failed to convert string to address ..."). Verified in-cluster that only an IP works (short name, FQDN both fail; `kea-dhcp4 -t` does not exercise this, which is why the v0.1.3 wait did not catch it). Pod IPs cannot be baked into the config because they change on restart and would roll-loop the StatefulSet via the config hash.

## How
- create one ClusterIP Service per HA peer, selecting the pod by its statefulset.kubernetes.io/pod-name label, with publishNotReadyAddresses so peers are routable during bootstrap
- render each HA peer url as its peer Service ClusterIP (a stable IP literal, safe in the config hash); reconcile Services before the ConfigMap and requeue until the ClusterIPs are allocated

internal/controller/helpers.go

@@ -29,6 +29,10 @@ const (
 	clusterLabel   = "kea.unkin.net/cluster"
 	roleLabel      = "kea.unkin.net/role"
 
+	// statefulSetPodNameLabel is stamped on every StatefulSet pod by Kubernetes;
+	// the per-pod ClusterIP Service selects a single pod through it.
+	statefulSetPodNameLabel = "statefulset.kubernetes.io/pod-name"
+
 	finalizer = "kea.unkin.net/finalizer"
 
 	defaultOperatorImage = "git.unkin.net/unkin/kea-operator:latest"
@@ -39,10 +43,20 @@ func headlessName(cluster string) string  { return cluster + "-headless" }
 func serviceName(cluster string) string   { return cluster }
 func configMapName(cluster string) string { return cluster + "-config" }
 func stsName(cluster string) string       { return cluster }
-func peerDNS(cluster, ns string, ordinal int) string {
-	return fmt.Sprintf("http://%s-%d.%s.%s:%d/", cluster, ordinal, headlessName(cluster), ns, 8000)
+
+// podName is the StatefulSet pod name for an ordinal.
+func podName(cluster string, ordinal int) string { return fmt.Sprintf("%s-%d", cluster, ordinal) }
+
+// peerServiceName is the per-pod ClusterIP Service fronting one HA peer's
+// ctrl-agent. Its stable ClusterIP is what the HA hook peer URL points at.
+func peerServiceName(cluster string, ordinal int) string {
+	return fmt.Sprintf("%s-peer-%d", cluster, ordinal)
 }
 
+// peerURL builds an HA peer control-channel URL. Kea 2.6's HA hook parses the
+// host as an IP literal (no DNS), so this must be a stable IP address.
+func peerURL(ip string) string { return fmt.Sprintf("http://%s:%d/", ip, 8000) }
+
 func commonLabels(cluster string) map[string]string {
 	return map[string]string{
 		managedByLabel: managedByValue,