refactor: extract dereference/validate pipeline from reconcile_hive

[adwk67]

Summary

• Derive Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd on HiveRole so it can be used as a BTreeMap key and in validated structs
• Extract external resource resolution (product image, S3 connection, metadata database, OPA config) into controller::dereference module with its own Snafu error enum
• Extract product-config validation and config merging into validate_cluster(), producing a ValidatedHiveCluster struct that proves all validation succeeded before any Kubernetes resources are created
• ValidatedHiveCluster owns the resolved product image and per-role/per-rolegroup merged configs; existing build functions are unchanged and receive parameters from the validated structs

Reviewer notes

• dereference() and validate_cluster() contain no new logic — they are pure extractions of code that was previously inline in reconcile_hive()
• The ValidatedHiveCluster struct intentionally has fewer fields than a full ownership model would (no name/namespace/uid/metadata validated types). This is a "construct but decompose" fail-fast gate: built early in reconcile to prove validation passes, then its fields feed the existing unchanged build functions
• The controller/ directory coexists with controller.rs — Rust treats controller.rs as the module root and looks for submodules in controller/. Currently just dereference, with validate and further stages to follow in later PRs
• The Dereference wrapper variant in the controller's Error enum replaces 3 individual error variants (ResolveProductImage, InvalidOpaConfig, InvalidMetadataDatabaseConnection) that moved into the new module's own error enum. ConfigureS3Connection and ObjectHasNoNamespace remain in the controller because they are still used by build functions
• Mirrors the pattern established in the airflow-operator (refactor: extract dereference/validate pipeline from reconcile_airflow airflow-operator#795)

Test plan

• Existing unit tests pass
• Clean compile with no warnings
• No behavioural changes — pure refactoring

🤖 Generated with Claude Code

[adwk67]

Jenkins: 🟢 (one failure on NS teardown) https://testing.stackable.tech/view/02%20Operator%20Tests%20(custom)/job/hive-operator-it-custom/52/

[siegfriedweber]

The smoke test of the opensearch-operator has an assertion that covers all generated resources (https://github.com/stackabletech/opensearch-operator/blob/26.3.0/tests/templates/kuttl/smoke/10-assert.yaml.j2). The other integration tests only add assertions for the resources specific to the test case (https://github.com/stackabletech/opensearch-operator/blob/26.3.0/tests/templates/kuttl/security-config/11-assert.yaml#L29-L41). That leads to relatively high test coverage.

The pull requests for stackabletech/issues#850 should only perform internal changes. If we also add an assertion to the smoke test with the resources produced before this change, then we could be more confident that no unwanted changes are introduced.

[adwk67]

Nice idea!

[adwk67]

Added here: fe53e9c. Tested across most smoke tests in main and in this branch to check there are no discrepancies before/after this PR.