fix: external search TLS cert paths point to nonexistent files in Server pod

[digiserg]

Summary

When external search has TLS enabled with InsecureSkipVerify: false, the cert paths in the server config remain at internal defaults (/etc/axonops/certs/search/*). But the Server pod does not mount external TLS certificates — it only mounts volumes for internal components. The configured paths point to nonexistent files, causing TLS connection failures at runtime.

Detailed Requirements

When external search is configured with TLS verification enabled, the Server pod must either:

1. Mount the external TLS certificates (CA cert, client cert, client key) into the pod at the configured paths, OR
2. Allow users to configure custom cert paths for external databases via the CRD spec

The current code sets cert paths in the server configuration but never creates the corresponding volume mounts.

Location

• internal/controller/axonopsserver_controller.go:2500-2516

Acceptance Criteria

1. External search TLS certs are properly mounted in Server pod when configured
2. Server successfully connects to external search with TLS verification enabled
3. Clear error is surfaced in status conditions if TLS certs are missing or invalid
4. BDD scenario covers external search with TLS enabled and InsecureSkipVerify: false

Testing Requirements

• Unit test: verify Server StatefulSet has correct volume mounts when external search TLS is configured
• Unit test: verify cert paths in server config match the mounted volume paths
• Integration test: Server connects to external search with TLS verification
• Negative test: missing cert secret produces clear error in status

Documentation Requirements

• Document how to configure TLS certificates for external search
• Add sample CR showing external search with TLS

Dependencies

• None