feat: add configurable GPU acceleration profiles

[vicotrbb]

Summary

• add opt-in, operator-owned GPU profiles with strict Helm schema and controller validation
• expose the same safe profile catalog through the authenticated API, devbox gpu profiles, devbox create --gpu / --gpu-profile, and the responsive dashboard
• map each profile to an exact extended resource and count, with optional workspace image, RuntimeClass, supplemental groups, node selector, and tolerations
• pin the resolved creation-time profile on each Deployment so stop, start, TTL expiry, profile retirement, and Insights reconciliation cannot silently change the workload contract
• surface Kubernetes scheduling reasons in API, CLI timeout, and dashboard state
• harden non-root device access by materializing approved group IDs for the OpenSSH dev session while keeping the Insights privacy sidecar on the release image
• document prerequisites, NVIDIA and AMD examples, dedicated / partitioned / shared semantics, DRA bridge compatibility, images, lifecycle, security, operations, support, and troubleshooting

Design

Users can select only a stable profile name. Images, resource names, counts, RuntimeClasses, groups, selectors, tolerations, privileged mode, host paths, and device paths remain operator policy. CPU-only stays the initial and default path.

Profiles use vendor-qualified Kubernetes extended resources, so they work with established device plugins and with DRA deployments that expose a compatible extended-resource bridge. Devboxes intentionally does not install cluster-wide drivers, runtimes, plugins, RuntimeClasses, or labels.

Validation

• make lint
• make test: 144 controller tests at 88.67% coverage and 22 CLI tests
• make helm: disabled, enabled, and invalid GPU chart contracts
• make images: both images plus terminal and real image-level device-group checks
• full disposable Kind lifecycle: capability discovery, CLI GPU creation, exact pod contract, Pending scheduler diagnostics, GPU cleanup, Insights, SSH, persistence, restart, retain, reuse, and purge
• dashboard and in-product docs QA at desktop, tablet, and mobile widths, including real create flow and a clean browser console

Hardware boundary

The clean-cluster test intentionally requests an unavailable extended resource to prove the portable contract and failure path. Physical-device validation remains vendor- and cluster-specific; the operator guide defines the required driver, runtime, image, diagnostic, stop/start, and per-profile acceptance checks.

Closes #18

Release

• synchronizes the chart, controller, CLI, lockfiles, installer, static assets, install examples, project status, Artifact Hub metadata, and changelog at v0.4.0
• keeps the release tag gated on the protected, squash-merged commit and the repository's immutable v* tag ruleset
• revalidates the release metadata locally with the full lint, test, and Helm suite before remote CI