refactor: full-stack restructure with multi-tenancy, workspace management, and K8s diagnostics

- Add Workspace domain (entity, repository, service, handler, DTO)
- Add multi-tenant K8s client with tenant binding and quota management
- Add K8s diagnostics client (instance diagnostics)
- Add authorization middleware (authz package)
- Restructure frontend to feature-based architecture (features/)
- Add User Management page in configuration
- Add AccessDenied page and route guards
- Refactor shared components (form inputs, layout, UI)
- Update Tailwind config for new design system
- Add comprehensive documentation (docs/, tasks/, plans)
- Improve cluster service with better kubeconfig handling
- Add tests for crypto, config, helm client, tenant binding

backend/internal/domain/service/instance_service_test.go

@@ -4,21 +4,26 @@ import (
 	"context"
 	"errors"
 	"testing"
+	"time"
 
 	persistencemock "github.com/ocdp/cluster-service/internal/adapter/output/persistence/mock"
 	"github.com/ocdp/cluster-service/internal/domain/entity"
 	"github.com/ocdp/cluster-service/internal/domain/repository"
+	"github.com/ocdp/cluster-service/internal/pkg/authz"
 )
 
 func TestDeleteInstanceIgnoresMissingRelease(t *testing.T) {
-	ctx := context.Background()
+	principal := &authz.Principal{UserID: "user-1", Username: "tester", Role: authz.RoleUser, WorkspaceID: entity.DefaultWorkspaceID}
+	ctx := authz.WithPrincipal(context.Background(), principal)
 	instanceRepo := persistencemock.NewInstanceRepositoryMock()
 
 	instance := &entity.Instance{
-		ID:        "inst-1",
-		ClusterID: "cluster-1",
-		Name:      "demo",
-		Namespace: "default",
+		ID:          "inst-1",
+		WorkspaceID: entity.DefaultWorkspaceID,
+		OwnerID:     "user-1",
+		ClusterID:   "cluster-1",
+		Name:        "demo",
+		Namespace:   "default",
 	}
 	if err := instanceRepo.Create(ctx, instance); err != nil {
 		t.Fatalf("failed to seed instance: %v", err)
@@ -40,8 +45,63 @@ func TestDeleteInstanceIgnoresMissingRelease(t *testing.T) {
 		t.Fatalf("DeleteInstance returned error: %v", err)
 	}
 
-	if _, err := instanceRepo.GetByID(ctx, instance.ID); !errors.Is(err, entity.ErrInstanceNotFound) {
-		t.Fatalf("expected instance removed, got err=%v", err)
+	waitForInstanceDeleted(t, ctx, instanceRepo, instance.ID)
+}
+
+func TestEnforceNamespaceValuesOverridesChartNamespaceKnobs(t *testing.T) {
+	instance := &entity.Instance{
+		Namespace: "ocdp-u-alice",
+		Values: map[string]interface{}{
+			"namespace":         "default",
+			"namespaceOverride": "default",
+			"targetNamespace":   "default",
+			"global": map[string]interface{}{
+				"namespace":         "default",
+				"namespaceOverride": "default",
+			},
+			"image": map[string]interface{}{
+				"repository": "nginx",
+			},
+		},
+	}
+
+	enforceNamespaceValues(instance)
+
+	if instance.Values["namespace"] != "ocdp-u-alice" {
+		t.Fatalf("expected top-level namespace to be enforced, got %#v", instance.Values["namespace"])
+	}
+	if instance.Values["namespaceOverride"] != "ocdp-u-alice" {
+		t.Fatalf("expected namespaceOverride to be enforced, got %#v", instance.Values["namespaceOverride"])
+	}
+	if instance.Values["targetNamespace"] != "ocdp-u-alice" {
+		t.Fatalf("expected targetNamespace to be enforced, got %#v", instance.Values["targetNamespace"])
+	}
+	global, ok := instance.Values["global"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("expected global map, got %#v", instance.Values["global"])
+	}
+	if global["namespace"] != "ocdp-u-alice" || global["namespaceOverride"] != "ocdp-u-alice" {
+		t.Fatalf("expected global namespace keys to be enforced, got %#v", global)
+	}
+}
+
+func waitForInstanceDeleted(t *testing.T, ctx context.Context, repo repository.InstanceRepository, id string) {
+	t.Helper()
+
+	deadline := time.After(2 * time.Second)
+	ticker := time.NewTicker(10 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-deadline:
+			_, err := repo.GetByID(ctx, id)
+			t.Fatalf("expected instance removed, got err=%v", err)
+		case <-ticker.C:
+			if _, err := repo.GetByID(ctx, id); errors.Is(err, entity.ErrInstanceNotFound) {
+				return
+			}
+		}
 	}
 }