feat(auth): manage email hook signing secret

[birdmanmandbir]

Outcome

• Generates one stable <project>-email-hook Secret when a Supabase Auth email hook is enabled.
• Uses the fixed key secret with the Standard Webhooks v1,whsec_<base64> format.
• Injects the Secret into GoTrue as GOTRUE_HOOK_SEND_EMAIL_SECRETS.
• Preserves the signing secret across reconciliations and publishes its name in project status.
• Keeps disabled hooks free of hook environment variables.

Why

The existing operator set the email hook URI and enabled flag but omitted the signing secret. A receiving Worker that correctly validates Standard Webhooks signatures could therefore not accept the callback.

Verification

• Red: focused controller/resource tests failed before the implementation because the secret generator/status field were missing.
• make test (controller envtest, all Go packages, generated CRD, format and vet)
• Initial full-suite run caught an empty SecretRef during early reconciliation; fixed by deriving the fixed name when status is not populated yet.