feat: add extraPortMappings support to ClusterSpec

[Ladas]

Closes #17

Summary

• Add ports: Vec<PortMapping> to ClusterSpec for KIND extraPortMappings
• Enables mapping host ports to container NodePorts for accessing services (Grafana, Prometheus, MLflow) from the host machine
• Required by the OTel benchmark demo (feat: add OTel observability benchmark demo experimental#13)

Test plan

• Integration test with tests/fixtures/port-mappings.yaml
• Validates non-zero ports and duplicate host ports
• KIND config correctly generates extraPortMappings on first control-plane node
• cargo test + cargo clippy clean (451 tests)

[praxis-bot]

PR Review

Summary: Clean feature addition -- CreateClusterConfig struct is a good refactor, port generation is correct (first CP node only), validation catches zero ports and duplicates, test coverage is solid. One validation gap where cluster port bindAddress isn't checked.

Severity	Count
Critical	0
Large	0
Medium	1

[praxis-bot]

[Medium] check_cluster_ports validates non-zero ports and unique host ports but does not validate bind_address as a valid IP when present. Service ports already do this via check_port_bind_address (line 275). Without it, a cluster port mapping with bindAddress: "not-an-ip" passes validation and produces a malformed KIND config that fails opaquely at kind create cluster time.

Add a bind_address check inside the port loop:

if let Some(addr) = &pm.bind_address {
    if addr.parse::<std::net::IpAddr>().is_err() {
        return Err(ForgeError::Validation(format!(
            "cluster {:?}: port mapping bind address {:?} is not a valid IP",
            cluster.name, addr,
        )));
    }
}