Feat/kubernetes job secret management

[amh1k]

Summary

Adds coordinator support for creating a benchmark Job and its temporary credential Secret in the configured workload namespace.

The coordinator creates the Secret first, then creates a Job that references it. If Job creation fails, the coordinator attempts to delete the Secret and reports any cleanup error alongside the original failure.

Changes

• Added coordinator configuration, per-run connection details, and benchmark options.
• Added an injectable Kubernetes client and an in-cluster constructor.
• Added typed Job and Secret manifest builders and runtime creation methods.
• Configured runner image, resources, ServiceAccount, execution deadline, and benchmark environment variables.
• Disabled Job retries and runner ServiceAccount token mounting.
• Added input and resource validation before resource creation.
• Added UID-protected Secret deletion with a separate 10-second cleanup timeout.
• Kept database initialization disabled unless explicitly requested.

Testing

Added unit tests covering manifest configuration, creation order, Secret references, validation, API failures, cancellation, and cleanup error handling.

Verified with:

go -C backend test ./...
go -C backend vet ./...
git diff --check

Follow-up

Job monitoring, output collection, complete resource cleanup, and wiring the Run() method are covered by the second subissue #17 . This PR does not expose benchmark execution through an API endpoint.
Closes #16