M1.5: NodeConfig dynamic informer + RBAC

Agent now watches nodeconfigs.flock.fritzlab.net via a client-go dynamic
informer, filters events to its own node name, and caches the typed
NodeConfig in memory (NodeConfigCache, atomic pointer). M2's IPAM will
read from that cache.

- pkg/agent/nodeconfig.go: informer + JSON-round-trip decode (avoids
  hand-written DeepCopy + scheme registration for this small a use).
- pkg/agent/server.go: starts the informer goroutine; Run terminates if
  the informer returns.
- pkg/api/v1alpha1: switch placeholder TypeMeta/ObjectMeta to metav1.
- deploy/rbac: get/list/watch on nodeconfigs.
- cmd/flock-agent: --kubeconfig flag for out-of-cluster runs (tests).

Satisfies M1 verified-by: "kubectl apply NodeConfig; agent logs read it".

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/api/v1alpha1/nodeconfig_types.go

@@ -1,5 +1,7 @@
 package v1alpha1
 
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
 // NodeConfigSpec is the operator-written desired state for a single node.
 //
 // The agent reads this on startup and via informer for live updates. There is
@@ -18,37 +20,27 @@ type NodeConfigSpec struct {
 }
 
 type BGPSpec struct {
-	// ASN is this node's local autonomous system number.
-	ASN uint32 `json:"asn"`
-
-	// Peers lists upstream BGP peers (typically the rack/site router).
+	ASN   uint32    `json:"asn"`
 	Peers []BGPPeer `json:"peers"`
 }
 
 type BGPPeer struct {
-	// Address is the peer's IP (IPv6 or IPv4).
 	Address string `json:"address"`
-	// ASN is the peer's autonomous system number.
-	ASN uint32 `json:"asn"`
+	ASN     uint32 `json:"asn"`
 }
 
-// NodeConfig is the Schema for the nodeconfigs API.
+// NodeConfig is the Schema for the nodeconfigs API. NodeConfigs are cluster-
+// scoped; their name matches the node name they configure.
 type NodeConfig struct {
-	TypeMeta   `json:",inline"`
-	ObjectMeta `json:"metadata,omitempty"`
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
 
 	Spec NodeConfigSpec `json:"spec,omitempty"`
 }
 
-// TypeMeta and ObjectMeta are minimal stand-ins so this package can be used
-// without dragging in k8s.io/apimachinery during the M1 scaffold. They will be
-// replaced by metav1.TypeMeta / metav1.ObjectMeta when the agent wires up
-// controller-runtime in M2.
-type TypeMeta struct {
-	Kind       string `json:"kind,omitempty"`
-	APIVersion string `json:"apiVersion,omitempty"`
-}
-
-type ObjectMeta struct {
-	Name string `json:"name,omitempty"`
+// NodeConfigList is needed for list RPCs even if the agent never lists.
+type NodeConfigList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []NodeConfig `json:"items"`
 }