feat(gateway): add /sync endpoint with mTLS client-certificate authentication

[MuhanedYahya]

Why

Part of the self-service kubeconfig bootstrap initiative (tracking issue TBD, linked once created). Lets already-bootstrapped users refresh their local kubeconfig without a new bootstrap token, using the credential they already hold to authenticate — mirrors kubelet's client-certificate rotation pattern.

Scope

• POST /sync on the gateway, requiring mTLS; extracts the CN from the presented client certificate.
• Verifies the presented cert against the cluster CA (reuse the CA-retrieval logic already in internal/controller/certs), including a bounded grace period past NotAfter so renewal still works for certs that are already expired-but-recent.
• Looks up the User matching the CN:
  • not found or deletionTimestamp set → distinct "user deleted" response, no retry-worthy signal
  • spec.auth.autoRenew == false → distinct "auto-renew disabled" response
  • else → compare against a version/hash the client sends for what it currently holds; return the current <username>-credentials secret only if changed
• Audit log every sync attempt and outcome.

Acceptance criteria

• Valid, current cert → correct kubeconfig returned only when changed
• Deleted user → distinct blocked response, verified via test
• autoRenew: false user → distinct blocked response, verified via test
• Expired-past-grace-period cert → rejected
• Manual end-to-end test on a kind cluster: rotate a user's cert, confirm /sync returns the new credentials

Depends on

#104 (gateway skeleton), #101 (single-credentials-secret shape)

[MuhanedYahya]

Part of #111