feat: add branch connect for k8s backend

[zxzinn]

Summary

• The k8s backend only creates a ClusterIP Service for a branch's compute (unlike the docker backend, which binds a host port directly). There was no way to reach a k8s-backed branch from the host without a separate kubectl port-forward invocation.
• Adds branch connect <name>: a blocking foreground command that forwards a local port to the compute Pod using client-go's programmatic portforward API (no kubectl subprocess). Daemonizing (if wanted) is left to the caller, following the same pattern kubectl port-forward and kubefwd use.
• PortForward lives directly on k8s.Backend, not the Backend interface — the docker backend has no equivalent need, and finding the target Pod requires a *rest.Config the interface doesn't expose.

Test plan

• go vet ./... and go test ./... pass, including new unit tests for findPod's label-selector logic (fake clientset) and trimScheme.
• Manual E2E against a real self-hosted Neon stack on EKS: branch create → branch connect --port 25555 → psql -h localhost -p 25555 -U cloud_admin -d postgres -c 'select 1;' returned 1.
• Verified graceful shutdown: SIGTERM to the connect process releases the port and exits 0 (confirmed via nc -zv connection-refused after kill, and via the background job's own exit code).