feat(bootstrap): add internal/controller/bootstrap package for bootstrap-token lifecycle

[MuhanedYahya]

Why

Part of the self-service kubeconfig bootstrap initiative (tracking issue TBD, linked once created). Need a controller-owned primitive that issues, hashes, expires, and resends bootstrap tokens before any HTTP surface (gateway) or email sending exists — testable in isolation by inspecting the Secret directly.

Scope

• New package internal/controller/bootstrap, following the existing style of internal/controller/renewal / internal/controller/rbac.
• On User reconcile, if spec.email is set and status.bootstrapPhase is NotConfigured: generate a random token, store only its SHA-256 hash + expiry (15–30 min TTL) + used: false in a new <username>-bootstrap-token Secret, owned via OwnerReference (reuse the fixed-TypeMeta pattern so garbage collection works correctly), set status.bootstrapPhase = Pending.
• Detect a kubeuser.io/resend-bootstrap annotation: invalidate any existing unused token, issue a fresh one, reset phase to Pending, clear the annotation.
• TTL sweep: expired, unused tokens get their Secret deleted (reuse timing/requeue patterns already established in internal/controller/renewal).
• Does not send email yet or expose any HTTP endpoint — that's separate sub-issues.

Acceptance criteria

• Token issuance creates <username>-bootstrap-token with only a hash at rest, never plaintext
• Resend annotation correctly invalidates the old token and issues a new one
• Expired unused tokens are swept
• Unit tests covering issuance, resend, expiry, and the "no email set" no-op case

Depends on

#102 (CRD fields), #101 (secret-naming conventions this package should follow)

[MuhanedYahya]

Part of #111