refactor: full-stack restructure with multi-tenancy, workspace management, and K8s diagnostics

- Add Workspace domain (entity, repository, service, handler, DTO)
- Add multi-tenant K8s client with tenant binding and quota management
- Add K8s diagnostics client (instance diagnostics)
- Add authorization middleware (authz package)
- Restructure frontend to feature-based architecture (features/)
- Add User Management page in configuration
- Add AccessDenied page and route guards
- Refactor shared components (form inputs, layout, UI)
- Update Tailwind config for new design system
- Add comprehensive documentation (docs/, tasks/, plans)
- Improve cluster service with better kubeconfig handling
- Add tests for crypto, config, helm client, tenant binding

backend/internal/domain/repository/tenant_kube_client.go

@@ -0,0 +1,15 @@
+package repository
+
+import (
+	"context"
+	"time"
+
+	"github.com/ocdp/cluster-service/internal/domain/entity"
+)
+
+// TenantKubeClient provisions namespace-scoped Kubernetes access for tenants.
+type TenantKubeClient interface {
+	EnsureTenant(ctx context.Context, cluster *entity.Cluster, binding entity.TenantBinding) error
+	IssueKubeconfig(ctx context.Context, cluster *entity.Cluster, binding entity.TenantBinding, ttl time.Duration) (*entity.TenantKubeconfig, error)
+	SuspendTenant(ctx context.Context, cluster *entity.Cluster, binding entity.TenantBinding) error
+}