Expose allocateLoadBalancerNodePorts in TenantControlPlane ServiceSpec

[Jakob3xD]

Summary

TenantControlPlane's spec.controlPlane.service (ServiceSpec) only exposes
serviceType, additionalMetadata, and additionalPorts. For a LoadBalancer
control plane the generated Service therefore inherits the Kubernetes default
allocateLoadBalancerNodePorts: true, so a NodePort (e.g. 30654) is always
allocated on every node — with no way to turn it off via the TCP.

Motivation

With Cilium + MetalLB (BGP), the API server should be reachable only via the
LoadBalancer VIP (and ClusterIP) on 6443, not additionally via a NodePort on
every node. Keeping the NodePort is an unnecessary exposure of the control plane.
Today the only workaround is patching the Service out-of-band
(kubectl patch ... allocateLoadBalancerNodePorts=false) — which happens to
persist because the reconciler never sets that field, but it's fragile and
undocumented.

Proposal

Add an optional allocateLoadBalancerNodePorts *bool to ServiceSpec. When set
and serviceType: LoadBalancer, propagate it to the generated Service's
spec.allocateLoadBalancerNodePorts. Default nil → current behaviour (true)
is preserved; no migration impact.

Implementation note: when set to false on a Service that already has a
NodePort assigned, the reconciler must also clear the port's nodePort, since
Kubernetes does not deallocate it automatically — and Kamaji's port loop
currently copies the live nodePort
(internal/resources/k8s_service_resource.go:106-114), so it would otherwise be
re-applied.

Out of scope

Only allocateLoadBalancerNodePorts. Other Service knobs
(externalTrafficPolicy, internalTrafficPolicy, sessionAffinity) are
intentionally left out of this issue.

---

_{🤖 Issue prepared with Claude Code.}

[prometherion]

This looks more like a feature rather than an Issue: this section is mostly used for bug reports, and Discussions for features planning.
I'm going to convert this into a Discussion for the sake of organisation.