K8s metrics sidecar registration rejected (401/404) in DEPLOYMENT_MODE=K8

[ravjotbrar]

Summary

Metrics sidecars cannot register with the orchestrator in Kubernetes (DEPLOYMENT_MODE=K8). The sidecar retries and exits after 30 attempts, so metrics panels never populate.

Register failed: 401 Unauthorized
Failed to register with server after 30 attempts. Shutting down.

Root cause

Regressed in #379. The /orchestrator/register handler requires a pre-existing metricsServerMap entry for the nodeId. In K8s the orchestrator never spawns collectors (sidecars are externally managed), so no entry is ever pre-populated and every registration is rejected.

A secondary gap: sidecars have no per-node key to authenticate with, because the orchestrator only mints per-node keys for collectors it spawns (Web/Electron).

Expected

A sidecar whose nodeId is part of the discovered cluster topology should be able to register (creating its entry on first register), authenticated by a shared key provisioned to both the orchestrator and the sidecars.

Scope

• Register-time membership check gated to K8s; the strict no-entry gate is preserved for spawned collectors.
• Shared ORCHESTRATOR_KEY via a Kubernetes Secret; resolveCollectorKey falls back to it in K8s only.