refactor: full-stack restructure with multi-tenancy, workspace management, and K8s diagnostics

- Add Workspace domain (entity, repository, service, handler, DTO)
- Add multi-tenant K8s client with tenant binding and quota management
- Add K8s diagnostics client (instance diagnostics)
- Add authorization middleware (authz package)
- Restructure frontend to feature-based architecture (features/)
- Add User Management page in configuration
- Add AccessDenied page and route guards
- Refactor shared components (form inputs, layout, UI)
- Update Tailwind config for new design system
- Add comprehensive documentation (docs/, tasks/, plans)
- Improve cluster service with better kubeconfig handling
- Add tests for crypto, config, helm client, tenant binding

backend/internal/adapter/output/helm/real/helm_client_test.go

@@ -0,0 +1,45 @@
+package real
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestKubeconfigGetterOverridesNamespace(t *testing.T) {
+	t.Parallel()
+
+	kubeconfigPath := filepath.Join(t.TempDir(), "kubeconfig")
+	kubeconfig := `apiVersion: v1
+kind: Config
+clusters:
+- cluster:
+    server: https://127.0.0.1:6443
+  name: test
+contexts:
+- context:
+    cluster: test
+    user: test
+  name: test
+current-context: test
+users:
+- name: test
+  user:
+    token: test
+`
+	if err := os.WriteFile(kubeconfigPath, []byte(kubeconfig), 0600); err != nil {
+		t.Fatalf("failed to write kubeconfig: %v", err)
+	}
+	getter := &kubeconfigGetter{
+		kubeconfigPath: kubeconfigPath,
+		namespace:      "ocdp-u-alice",
+	}
+
+	namespace, _, err := getter.ToRawKubeConfigLoader().Namespace()
+	if err != nil {
+		t.Fatalf("Namespace returned error: %v", err)
+	}
+	if namespace != "ocdp-u-alice" {
+		t.Fatalf("expected namespace override %q, got %q", "ocdp-u-alice", namespace)
+	}
+}