fix(controller): prevent Team auto-reconciliation after explicit deletion (#1143)

[nillikechatchat]

Fixes #1143

问题

删除 Team 后，reconciler 在 2 秒内自动恢复 Team。

修复方案

1. 新增注解 agentteams.io/delete-requested 标记用户主动请求删除
2. HTTP DELETE handler 在发起删除前先写入该注解
3. Reconciler 在 finalizer 已移除后检查该注解，跳过正常 reconcile
4. 新增单元测试覆盖防护逻辑

变更文件

• api/v1beta1/types.go: 新增注解常量 AnnotationTeamDeleteRequested
• internal/controller/team_controller.go: 添加注解检查逻辑
• internal/server/resource_handler.go: DeleteTeam 前置注解写入
• internal/controller/team_controller_test.go: 新增 2 个测试用例

测试

全部单元测试通过，无回归。

---

Fixes #1143

Question

After deleting Team, reconciler automatically restores Team within 2 seconds.

Repair plan

1. Added annotation agentteams.io/delete-requested to mark the user actively requesting deletion
2. HTTP DELETE handler writes this annotation before initiating deletion
3. Reconciler checks this annotation after the finalizer has been removed, skipping the normal reconcile
4. Added unit test coverage protection logic

Change files

• api/v1beta1/types.go: Added annotation constant AnnotationTeamDeleteRequested
• internal/controller/team_controller.go: Add annotation checking logic
• internal/server/resource_handler.go: DeleteTeam pre-annotation writing
• internal/controller/team_controller_test.go: Add 2 new test cases

Test

All unit tests passed, no regression.

[shiyiyue1102]

Thanks for the contribution. I reproduced #1143 locally on v1.2.0 and confirmed that the Team was never recreated: the UID stayed unchanged, while deletionTimestamp and the cleanup finalizer remained because the controller repeatedly failed with Tuwunel's cannot invite user that is joined or banned response. #1140 has now been merged into main and fixes this exact finalizer failure.

The annotation guard in this PR runs only after the existing deletionTimestamp branch, so it does not unblock deletion finalization; I also verified that the two new tests still pass after removing the guard. Please retest against the current main; if #1143 no longer reproduces, this PR can be closed as superseded by #1140.

---

感谢贡献。我在本地 v1.2.0 环境复现了 #1143，并确认 Team 从未被重新创建：删除前后 UID 保持不变，Controller 因 Tuwunel 返回 cannot invite user that is joined or banned 而持续失败，导致 deletionTimestamp 和 cleanup finalizer 一直保留。#1140 已合入 main，修复了这个明确的 finalizer 失败。

本 PR 的 annotation guard 位于现有 deletionTimestamp 分支之后，无法解除删除 finalizer；我也验证了移除该 guard 后，新增的两个测试仍然通过。请基于当前 main 复测；如果 #1143 不再复现，本 PR 可以作为已被 #1140 覆盖而关闭。