fix: stabilize Traefik reconciliation and instance identity

[StefanSa]

Summary

• reconcile external HTTP load-balancer targets through generated Kubernetes Services and EndpointSlices instead of unsupported TraefikService loadBalancer fields
• use server-side apply from initial creation with the stable pangolin-kube-controller field manager
• safely adopt legacy controller Update spec ownership only for controller-managed resources
• propagate configured Traefik instance identity through generic and specialized IngressRoute, TCP, and UDP paths
• preserve unrelated metadata and repair missing controller-owned identity in place

Production compatibility

This complete set is required for current Traefik CRD schemas: external HTTP targets must be converted before SSA, while generated Traefik resources retain stable ownership and the configured production instance identity.

Validation

• go test ./...
• go vet ./...
• production validation covers controller readiness, clean reconciliation, external HTTP targets, SSA ownership, instance-label persistence, CrowdSec, Bitwarden, Forgejo, and codex-lb

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.4% Duplication on New Code

See analysis details on SonarQube Cloud