Reload the password fingerprint key when its Secret changes or is deleted #73

Follow-up from the review of #71: #71 (comment)

Current behavior

PasswordFingerprintService.getKey() reads the key Secret postgresql-operator-password-fingerprint-key once. It then keeps the key in memory for the lifetime of the process and never invalidates it.

When the key Secret is deleted or changed, a running operator keeps the old key. It creates a new Secret only after a restart. #71 documents this: to retire a key, delete the key Secret and restart the operator.

With more than one operator replica, each replica holds its own copy of the key. After a key rotation without a restart of all replicas, the replicas compute different fingerprints for the same password.

Proposal

Watch the key Secret, for example with an informer on the operator namespace. Drop the cached key when the Secret changes or is deleted. The next reconcile then loads the new key or generates one, and re-applies every Role password once.

Acceptance criteria

• A deleted key Secret causes a new key without a restart.
• A changed key Secret causes the operator to use the new key without a restart.
• A test uses the same service instance before and after the Secret change. The current test whenSecretLost_shouldCreateNewKey uses a new instance, so it does not cover this.
• Update docs/role.md and the Javadoc of PasswordFingerprintService to remove the restart step.