prototype for supporting per-CR Vault/S3 client construction

[travisbcotton]

Description

What it does

Adds vaultClientFor(ctx, cp) and s3ClientFor(ctx, cp) factory methods on the controller (new file internal/controller/clients.go) that build the clients per-CR from spec.platform.* plus the Secrets that spec references, instead of from process-wide env vars. The controller calls them in both reconcileAll and reconcileDelete.

Key design decisions (all flagged in code comments for reviewers)

1. Struct fields become an optional override. r.VaultClient/r.S3Client are checked first in each factory. If set (unit tests inject fakes; make dev-run injects env clients), they win. This is why the entire existing test suite passes untouched — no test changes needed.

2. Graceful degradation preserved. Every failure path (missing spec, missing Secret, unreachable, auth failure) returns (nil, nil), so the existing nil-guards in vault.go/bucket.go/logbucket.go report *Configured=False/*Ready=False and requeue — matching today's non-crashing semantics.

3. S3 credentials reuse the existing convention. The factory reads the VSO-synced openchami-<cluster>-s3-credentials Secret (keys access_key/secret_key) — the same Secret bucket.go/logbucket.go already fetch but never used. This closes the latent gap I found earlier.

4. Added spec.platform.objectStorage.region (CRD regenerated).

Deliberately unresolved — (marked OPEN QUESTIONS in clients.go)

• S3 cred provenance: convention Secret (used here) vs. an explicit credentialsSecretRef.
• Vault client caching: currently a login round-trip per reconcile; may want a per-CR cache.
• AppRole resolution from appRoleSecretRef (expects role_id/secret_id keys) — needs confirmation that matches how operators populate that Secret.
• Deletion-path limitation: on delete, the namespace/credentials Secret may already be gone, so opt-in bucket cleanup would silently skip. Flagged inline as needing cleanup creds that outlive the namespace.
• Dev token auth: not expressible in the CRD enum, so dev still relies on the env-injected override. main.go is intentionally left as-is (dev keeps working).

Fixes #15

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.