fix: iaas client only created once

[craigvanaman]

Only create the iaas client once and use it for all STACKIT connections.

---

Note

Lazily initialize and reuse a single STACKIT SDK IaaS client per provider instance, removing per-call credentials and updating core flows, interfaces, tests, and docs.

• Provider/Core:
  • Add ensureClient for lazy, single-tenant client initialization and reuse; warn on credential changes.
  • Update CreateMachine, DeleteMachine, GetMachineStatus, ListMachines to init client once and drop per-call credentials in client invocations.
• SDK Client & Interface:
  • Introduce NewStackitClient with stored iaasClient; extract createIAASClient.
  • Change StackitClient methods to CreateServer/GetServer/DeleteServer/ListServers(ctx, projectID, region, ...) (remove serviceAccountKey params).
  • Implement methods using the persistent SDK client; keep 404 handling via ErrServerNotFound.
• Tests/Mocks:
  • Adjust mocks and all tests to new method signatures and single-client behavior.
• Docs:
  • README: document single-project binding, lazy init, token refresh, and credential rotation requiring pod restart; clarify env vars.

^{Written by Cursor Bugbot for commit cb448d3. This will update automatically on new commits. Configure here.}

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Client Silently Ignores Credential Updates.

The ensureClient method accepts a serviceAccountKey parameter but only uses it during the first call due to sync.Once. If subsequent requests provide different credentials (e.g., after Secret rotation), they're silently ignored and the client continues using the original credentials. This creates a mismatch between the credentials passed in requests and those actually used by the client, potentially causing authentication failures or security issues.