[msdmazvoid]

Summary

Phase 1 of the kouja storage backend, stacked on feat/kouja-storage-backend-phase0.

This adds the kouja client/config/error contract and the provisioner, start preparer, and control-plane health checker. It intentionally does not add the storage driver, QEMU start path, gateway wiring, UI, or Terraform changes.

What changed

• Pin github.com/voidstarit/kouja to main commit 5dd27b7c76f0214afb47499cfea990184d9c830c and use the generated gRPC client SDK.
• Add per-backend mTLS client factory with LoadTLSConfig, server-name override, request-ID propagation, and connection ownership.
• Validate endpoint, protocol, storage class, iSCSI IQN / NVMe host NQN, absolute certificate paths, key permissions, portal/address rules, and the single spiffe://kouja/caller/<name> URI SAN.
• Add cleanup/error classification: NOT_FOUND success, session retry overrides, generated-client retryability, and terminal errors.
• Add volume creation/validation that returns a secret-free blockdev.Reference for iSCSI and NVMe/TCP.
• Add start preparation that checks live export/state, observation freshness, session ownership, owner identity, stored-vs-live export fields, and fetches the CHAP/PSK credential into a runtime blockdev.Attachment.
• Add control-plane health: endpoint readiness, requested protocol, storage-class capacity, and an existing-volume owner/credential sample.
• Add tests for config validation, certificate SANs, client factory, retry classification, provisioner responses, preparer safety checks, and health.

Verification

• go test ./... -count=1
• go vet ./...
• make proto-check
• make proto-compile
• gofmt clean
• Local diff coverage against the Phase 0 base: 83%

Chain

Base PR: #32 (feat/kouja-storage-backend-phase0). Merge Phase 0 first, then this PR.

Review-artifact scratch files are intentionally excluded.