feat(jobs): tolerations and node affinity for operator-managed jobs

[Azerothian]

Closes #18

What

Adds spec.jobScheduling to TemporalCluster, a global scheduling block applied to the pods of every Job the operator creates (database creation, schema setup and schema update — all built through persistence.SchemaJobBuilder):

spec:
  jobScheduling:
    tolerations:
      - key: dedicated
        operator: Equal
        value: temporal
        effect: NoSchedule
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: workload
                  operator: In
                  values: [temporal]

Both fields use the core Kubernetes types ([]corev1.Toleration, *corev1.Affinity), so anything valid in a pod spec is valid here, including pod affinity/anti-affinity. The accessors (GetTolerations/GetAffinity) are nil-safe, so a cluster that never sets the field is unaffected.

Why

Without this, on clusters whose temporal nodes are tainted or dedicated the operator's jobs either land on the wrong nodes or stay Pending forever — which blocks the whole cluster reconcile, since persistence setup gates the rest. There was previously no way to express this (alexandrevilain#704).

Files

• api/v1beta1/temporalcluster_types.go — JobSchedulingSpec + nil-safe accessors, TemporalClusterSpec.JobScheduling
• internal/resource/persistence/schema_setup_job_builder.go — tolerations/affinity on the job pod template
• regenerated zz_generated.deepcopy.go, config/crd/bases, chart CRD, docs/api/v1beta1.md
• internal/resource/persistence/schema_setup_job_builder_test.go — unit tests (unset / empty / tolerations only / affinity only / both, plus nil-safety)
• docs/features/job-scheduling.md + mkdocs.yml nav + CHANGELOG.md

Verification

• go build ./... ✓
• go vet ./... ✓
• gofmt clean ✓
• make manifests + make api-docs regenerated and consistent (CRD and docs contain no drift)
• go test ./api/... ./internal/... ./controllers/... — all ok (incl. full envtest controller suite, 7.5s, and the new TestSchemaJobBuilderScheduling)

Live-cluster verification on bne1-cluster1 was not possible for this run: the host's container runtime is down (containerd panics on a corrupt bbolt metadata DB, docker cannot connect), so the operator image could not be built/loaded. The change is additive (optional field) and the envtest suite exercises the reconcile path; the new unit test asserts the scheduling fields land on the Job pod template.

Note: Jobs are immutable, so changing spec.jobScheduling applies to jobs created afterwards; an already-pending job must be deleted for new constraints to take effect. This is documented.