refactor: extract dereference/validate pipeline from reconcile_hive

[adwk67]

Summary

• Derive Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd on HiveRole so it can be used as a BTreeMap key and in validated structs
• Extract external resource resolution (product image, S3 connection, metadata database, OPA config) into controller::dereference module with its own Snafu error enum
• Extract product-config validation and config merging into validate_cluster(), producing a ValidatedHiveCluster struct that proves all validation succeeded before any Kubernetes resources are created
• ValidatedHiveCluster owns the resolved product image and per-role/per-rolegroup merged configs; existing build functions are unchanged and receive parameters from the validated structs

Reviewer notes

• dereference() and validate_cluster() contain no new logic — they are pure extractions of code that was previously inline in reconcile_hive()
• The ValidatedHiveCluster struct intentionally has fewer fields than a full ownership model would (no name/namespace/uid/metadata validated types). This is a "construct but decompose" fail-fast gate: built early in reconcile to prove validation passes, then its fields feed the existing unchanged build functions
• The controller/ directory coexists with controller.rs — Rust treats controller.rs as the module root and looks for submodules in controller/. Currently just dereference, with validate and further stages to follow in later PRs
• The Dereference wrapper variant in the controller's Error enum replaces 3 individual error variants (ResolveProductImage, InvalidOpaConfig, InvalidMetadataDatabaseConnection) that moved into the new module's own error enum. ConfigureS3Connection and ObjectHasNoNamespace remain in the controller because they are still used by build functions
• Mirrors the pattern established in the airflow-operator (refactor: extract dereference/validate pipeline from reconcile_airflow airflow-operator#795)

Test plan

• Existing unit tests pass
• Clean compile with no warnings
• No behavioural changes — pure refactoring

🤖 Generated with Claude Code