refactor(loadbalancer): target pool ownership

[Herbaert]

Closes #24

The API server load balancer is created by the StackitCluster reconciler while its target
pool was maintained by StackitMachine. That leaked cluster-level infrastructure into the
machine controller and let several machines write to the same pool concurrently. STACKIT takes
an explicit target list rather than label-based membership, so the pool now has exactly one
owner.

• StackitCluster watches control-plane Machine events and rebuilds the pool from
  Machine.Status.Addresses, which Cluster API propagates from StackitMachine.status.addresses.
  No RBAC change. The watch carries a predicate, since control plane status updates are frequent
  and each one would otherwise cost a full reconcile.
• EnsureAPIServerLoadBalancerTarget and DeleteAPIServerLoadBalancerTarget are replaced by
  SetAPIServerLoadBalancerTargets, which applies the pool as a set and skips the write when
  nothing changed. reconcileAPIServerLoadBalancerTarget, deleteAPIServerLoadBalancerTarget
  and EnsureForMachine are gone.
• Replacing the pool wholesale means one bad entry rejects every target, and a 400 is not
  retryable. Machine names are therefore sanitized into valid display names, with a digest
  against collisions, and duplicate target IPs are dropped.
• An empty desired set never overwrites a populated pool. Deleting a cluster removes the control
  plane before the infrastructure, so every machine is filtered out at once while the API server
  is still needed for drain and etcd member removal.
• A target pool failure requeues even when the error is permanent, raises a warning event, and
  sets only LoadBalancerReady, never Ready. The machine reconciler stops while the cluster is
  not ready, so failing the cluster would block replacing the machine whose target is broken.

Accepted trade-off: removing a target is no longer a precondition of the machine finalizer.
If the cluster controller is wedged, a target pointing at a dead IP survives, and the create path
sets no ActiveHealthCheck that would fail it out. Should STACKIT recycle that IP, the load
balancer forwards API traffic to an unrelated VM.

make lint, make test and make manifests are clean, config/ is unchanged. The specs for the
pool collapse and the permanent-failure case were checked against the unfixed code and fail there.
E2E was not run.