feat: pool CEL validation, tenant DNS limits, KMS alignment, and tooling

[GatewayJ]

Type of Change

• New Feature
• Bug Fix
• Documentation
• Performance Improvement
• Test/CI
• Refactor
• Other:

Related Issues

N/A

Summary of Changes

This PR bundles operator hardening and user-facing improvements:

• Pool validation: Align CRD CEL rules and Rust #[x_kube(validation)] with the console API — require servers × volumesPerServer ≥ 4 for every pool and ≥ 6 total volumes when servers == 3 (fixes incorrect 3-server CEL logic). Add shared validate_pool_total_volumes in src/types/v1alpha1/pool.rs with unit tests; regenerate deploy/rustfs-operator/crds/tenant-crd.yaml and tenant.yaml.

• Tenant naming: Enforce DNS-1035 rules and cap metadata.name at 55 characters so derived names such as {name}-console stay within Kubernetes DNS label limits. Validate on reconcile and on console tenant creation; add InvalidTenantName and 60s requeue for user-fixable errors.

• Encryption / KMS: Align injected pod environment variables with the RustFS server and rustfs-kms naming (RUSTFS_KMS_ENABLE, RUSTFS_KMS_VAULT_ADDRESS, local RUSTFS_KMS_KEY_DIR / RUSTFS_KMS_DEFAULT_KEY_ID, etc.). Remove tlsSkipVerify and customCertificates from API, console UI, and types (they were not wired to rustfs-kms). Run validate_kms_secret whenever spec.encryption.enabled is true. Add Local KMS validation (absolute keyDirectory, single replica across pools). Update CRD descriptions; reserve ping_seconds without injecting until supported.

• Tooling & docs: Expand root README.md; deploy scripts use Docker layer cache by default (RUSTFS_DOCKER_NO_CACHE for clean rebuild); Dockerfile improvements (cargo-chef pin, console-web pnpm pin). Add Cursor skill .cursor/skills/rustfs-operator-contribute and adjust .gitignore to version skills.

Checklist

• I have read and followed the CONTRIBUTING.md guidelines
• Passed make pre-commit (fmt-check + clippy + test + console-lint + console-fmt-check)
• Added/updated necessary tests
• Documentation updated (if needed)
• CHANGELOG.md updated under [Unreleased] (if user-visible change)
• CI/CD passed (if applicable)

Impact

• Breaking change (CRD/API compatibility)
• Requires doc/config/deployment update
• Other impact:

Breaking / migration: Remove spec.encryption.vault.tlsSkipVerify and customCertificates from Tenant YAML if present. If you relied on per-encryption securityContext, confirm the CRD layout in this branch (securityContext at Tenant spec level when applicable). See CHANGELOG.md under [Unreleased].

Verification

make pre-commit

Additional Notes

N/A

---

Thank you for your contribution! Please ensure your PR follows the community standards (CODE_OF_CONDUCT.md) and sign the CLA if this is your first contribution.