fix(config): deep-merge extraConfig and reject reserved paths

[tdakkota]

The bug

renderConfig merged spec.extraConfig over the generated config with maps.Copy(cfg, extra) — a
shallow, top-level copy. Because the operator renders everything that matters under a single
storage key, any extraConfig that mentions storage discarded the whole generated block:
backend, dir, cluster.etcd/rf/shards_per_tenant, s3 and the engine tuning.

Impact

Silent, and in the worst direction: an absent backend defaults to the ephemeral memory
backend (the PVC is mounted and unused, data is lost on restart) and an absent cluster block means
the node leaves the cluster (no etcd, no ring, no replication). Nothing flagged it — both
configs are legal on their own.

The fix

1. Deep merge. extraConfig is merged recursively: nested objects merge key by key, everything
   else (scalars, lists, explicit nulls) replaces. extraConfig: {storage: {policy: ...}} now adds
   storage.policy and keeps backend, dir and cluster.
2. Reserved paths are rejected, not merged. A deep merge alone still lets extraConfig
   overwrite storage.cluster.etcd or storage.backend, so the paths the operator renders from the
   spec are reserved: the signal backends, storage.backend/dir/wal_dir/s3, the whole
   storage.cluster subtree, and the storage.* engine tuning keys. Setting one fails the reconcile
   with an error naming the offending path and the spec field to use instead.
3. Reported via the existing status machinery. Spec-level problems (reserved paths, unparsable
   extraConfig, missing etcd.endpoints, missing S3 bucket) are wrapped in a validationError and
   surface as Degraded with reason InvalidSpec, and are not requeued — retrying cannot fix them,
   a spec change re-triggers reconcile.

Docs: the extraConfig field godoc, the regenerated CRD and a README table of reserved paths.

Tests

Table tests for deepMerge and validateExtraConfig, plus renderConfig regressions asserting
that extraConfig: {storage: {policy: ...}} preserves backend/dir/cluster and that a reserved
path fails validation. make test and make lint pass.

Closes #1

🤖 Generated with Claude Code