Introduce generic reconciler and migrate ClickhouseUser

[ndk]

About this change—what it does

This PR introduces a generic Reconciler[T] for AivenManagedObject resources and wires the new ClickhouseUser v2 controller through it. The old ClickhouseUser controller and basic_controller remain as-is. The new stack is opt-in behind an env flag.

Resolves: #NEX-2037.

Why this way

The generic reconciler owns the full control flow. Resource-specific code only implements AivenController[T] (Observe/Create/Update/Delete).

flowchart TD
  A[Reconcile] --> B[Get object]
  B --> C[Build Aiven client]
  C --> D{Marked for deletion?}
  D -->|yes| F[Finalize & remove finalizer]
  D -->|no| E[Ensure instance finalizer]

  E --> G[Observe]
  G --> H{Preconditions OK?}
  H -->|error| H1[Set error condition\nrequeue short]
  H -->|no| H2[Not met\nrequeue short]
  H -->|yes| I{Resource exists?}

  I -->|no| J[Create]
  J --> J1[Emit create events]
  J1 --> J2[Requeue pollInterval]

  I -->|yes| K{Up to date?}
  K -->|no| L[Update]
  L --> L1[Emit update events]
  L1 --> L2[Sync Secret if needed]
  L2 --> L3[Requeue pollInterval]

  K -->|yes| M[Steady state]
  M --> M1[Requeue pollInterval]

Loading

Key points:

• Token and Aiven client are resolved once per reconcile. newController receives a ready avngen.Client.
• Deletion is handled centrally (finalize): deletion policy, Aiven errors, and finalizer removal are uniform across resources.
• Status persistence (updateStatus) reuses one implementation: DeepEqual + RetryOnConflict for object and status.
• The decision to Create, Update, do nothing uses only:
  • Observation.ResourceExists
  • Observation.ResourceUpToDate
    Plus PreconditionsMet/PreconditionError to short-circuit when the parent service or environment is not ready.
• Connection secrets are published generically from UpdateResult.SecretDetails via syncConnectionSecret.

The idea is that new controllers only need to describe "how to talk to Aiven" in AivenController[T], while the Kubernetes mechanics (finalizers, conditions, events, requeue policy, secrets, status updates) are implemented once in Reconciler[T].