perf(controller): react to node and endpoint changes instead of polling

[lexfrei]

Target changes now reach the balancer through watches instead of a 30-second requeue, so a balancer that nothing changed costs one or two Hetzner requests every five minutes.

A node change reconciles every service when something target selection reads has changed: labels, cordoning, readiness or addresses. Heartbeats are ignored. For robotlb balancers with the Local traffic policy, an EndpointSlice change reconciles its service when the nodes its targets follow changed. With a selector these are all endpoint nodes, since targets come from pods. Without one they are the ready ones. Readiness flaps and address changes that leave those nodes alone cost nothing.

The controller's watch mapper cannot tell a deleted slice from an updated one. A second watch, metadata only, tracks which slices exist, and a deleted slice with endpoints reconciles every service. Controller::reconcile_on could target only its service, but it is still behind an unstable kube feature, so a comment marks the place to switch.

The resync is ROBOTLB_RESYNC_INTERVAL, 300 seconds by default and between one second and a year. Finished pods and pods without an IP no longer count as targets. Neither is in the endpoint slice, so their removal would otherwise wait for the resync.

When Hetzner refuses a target for a reason other than the rate limit, the service is checked again within 30 seconds instead of at the resync, as before. A node refused for good, such as one outside the vSwitch subnet, keeps its service on that cycle. The README says so, and #54 is about telling temporary refusals from permanent ones.

Known limits: every node change that matters reconciles all services, so a node going through cordon, drain and back triggers a few rounds. Both EndpointSlice watches also run with ROBOTLB_DYNAMIC_NODE_SELECTOR=false, where they trigger nothing.

This is stacked on #37 and targets its branch.

Closes #39