Bring-your-own serving certificate for the aggregated API server

[ThomasK33]

Since #140 and #141, the aggregated API server generates its serving CA in the coder-k8s-apiserver-tls Secret and keeps the APIService caBundle in sync. Some clusters want to supply their own certificate instead, for example issued by cert-manager or a corporate CA.

Today the server adopts any valid Secret unchanged, but it still renews the serving certificate with the Secret's CA key, so it needs that key. The opt-out annotation coder.com/manage-ca-bundle=false only stops the caBundle sync.

Proposal: a bring-your-own mode (a flag, or a Secret annotation) in which the server:

• only reads a kubernetes.io/tls Secret, possibly without the CA key;
• never generates or renews certificates;
• reloads the certificate when the Secret changes;
• fails clearly when the certificate is close to expiry.

Document how this mode works with cert-manager's CA injector and with the opt-out annotation.

Acceptance:

1. With BYO mode on, the server serves the supplied certificate and never writes the Secret. Show this with unit tests and a Kind proof.
2. Rotating the supplied Secret is picked up without a restart.
3. The docs cover setup with cert-manager.

Owner: maintainer desk. Trigger: user demand, or after the namespaced Role issue lands. Refs #137.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: medium