Feat/integration fluxcd

[gjorgji-ts]

Motivation

Adds FluxCD integration for LightsOutSchedule and LightsOutNamespaceSchedule. Without suspension, FluxCD reconciles workloads back to their git-defined replica counts within one reconcile interval, silently undoing downscale operations.

Also fixes a pre-existing bug in analyzeScheduleFrequency that caused yearly cron schedules to compute the wrong state after ~90 days past their last occurrence.

Changes

• FluxCD integration (internal/controller/fluxcd.go) suspends matching Kustomization and HelmRelease resources on downscale. Resumes with a warming-up grace period on upscale. Supports cluster-wide (spec.targetNamespace) and co-located (resource lives in target namespace) discovery patterns. RBAC is opt-in via rbac.fluxcd: true. Added ownership guard to prevent tagging unmanaged Flux resources during upscale reconciliation (handleFluxCDWarmup).
• Any cron with a single specific month now returns frequencyRare (400-day window) instead of frequencyMonthly (90-day window), fixing wrong state calculation for yearly schedules after ~90 days (period.go).
• Updated README, architecture, security model, setup guide. Added docs/fluxcd.md.

Testing

• Unit tests added for all FluxCD functions.
• period_test.go regression test for the yearly cron frequency bug.
• All time.Now() calls in tests replaced with fixed time.Date(...) values.

Checklist

• Tests added / updated
• Docs updated if behaviour changed
• make lint passes
• make test passes
• make manifests generate run if API types changed
• make helm-crds run if CRDs changed