refactor: extract dereference/validate pipeline from reconcile_airflow

[adwk67]

Summary

• Derive Ord/PartialOrd on AirflowRole so it can be used as a BTreeMap key
• Extract external resource resolution (product image, auth, authz, internal secrets) into controller::dereference module with its own Snafu error enum
• Extract product-config validation and config merging into validate_cluster(), producing a ValidatedAirflowCluster struct that proves all validation succeeded before any Kubernetes resources are created
• ValidatedAirflowCluster owns the resolved product image and per-role/per-rolegroup merged configs; existing build functions are unchanged and receive parameters from the validated structs

Reviewer notes

• dereference() and validate_cluster() contain no new logic — they are pure extractions of code that was previously inline in reconcile_airflow()
• The ValidatedAirflowCluster struct intentionally has fewer fields than a full ownership model would (no name/namespace/uid/metadata validated types, no precomputed_pod_data). This is a "construct but decompose" fail-fast gate: built early in reconcile to prove validation passes, then its fields feed the existing unchanged build functions
• The controller/ directory is introduced as a home for pipeline stages — currently just dereference, with validate and further stages to follow in later PRs
• The Dereference wrapper variant in the controller's Error enum replaces 4 individual error variants (ResolveProductImage, InvalidAuthenticationConfig, InvalidAuthorizationConfig, InvalidInternalSecret) that moved into the new module's own error enum

Test plan

• All 27 existing unit tests pass
• Clean compile with no warnings
• No behavioural changes — pure refactoring

🤖 Generated with Claude Code