fix: redact Hetzner errors and retry transient balancer deletion

[pando85]

Summary

• Report all reconciliation failures as Kubernetes Warning Events on the affected Service, including invalid annotations, finalizer cleanup and Hetzner errors. Keep the existing InvalidLoadBalancerConfiguration reason; use SyncLoadBalancerFailed for other failures.
• Redact Hetzner API tokens (and quoted prefixes >=8 bytes) in controller error logs and Events, and safely truncate Event notes to Kubernetes' 1024-byte limit at a UTF-8 boundary.
• Apply the existing bounded 409/423/5xx/robot_unavailable retry helper to both LB deletion entry points before removing the finalizer. Do not retry permanent errors or project-wide 429s.
• Throttle identical Warning Events to once per five minutes per Service UID, reason and redacted message. Different errors publish immediately; concurrent reconciles share an atomic reservation, and failed Event writes release the reservation. Expired entries are pruned.
• Add tests covering redaction, Event notes, throttling/expiry, distinct errors, concurrent reservations and transient/permanent delete response handling.

Notes

• Follows merged PR fix: port upstream controller safety and reconciliation improvements #62, no legacy-adoption behavior or automatic target truncation introduced.
• No dependency changes. Cargo.lock freshness is tracked separately in Renovate.
• Exercise a disposable Hetzner LB delete during an in-flight action before production rollout.

Validation

CI runs cargo fmt, cargo clippy --all-targets -- -D warnings, cargo test --all-targets --locked and Helm unit tests.

[forkline]

The clippy collapsible_if error and rustfmt formatting issues were already fixed in commit 5ef1b7f. The nested if blocks were collapsed and tracing macro calls were reformatted. No additional changes needed.

[forkline]

✅ Fix pushed:

The CI issues (clippy collapsible_if lint and rustfmt formatting) were already fixed in commit 5ef1b7f. The branch is up to date with origin - no additional changes needed.

[forkline]

⏸️ CI Auto-Fix paused

A user commit was detected after an automated fix. CI auto-fix is now paused
to prevent conflicts with your changes.

To resume CI auto-fix, use the /reset or /reset-ci-auto-fix command.