fix: deletion defects and resource orphans

[Herbaert]

Summary

Fixes deletion defects in the cluster and machine reconcilers where deletion could
hang and leave STACKIT resources orphaned.

Fixes #8

Changes

• StackitCluster keeps its finalizer and requeues while Machines for the
  cluster still exist, so those machines can still resolve credentials and delete
  their servers. The cluster reconciler's RBAC gains get;list;watch on machines.
• StackitMachine deletion resolves the server by tags when
  status.instanceID is empty, instead of treating an empty status as proof that
  no VM exists.
• Finalizers are persisted before the first cloud call, so a crash in between
  cannot leave a running server or load balancer behind an object that carries no
  finalizer to clean it up.
• StackitMachine deletion finalizes with a CleanupSkipped warning event
  when the credentials Secret is gone, matching what the cluster reconciler
  already does.
• The StackitCluster → StackitMachine watch resolves the owning Cluster
  before matching Machine.spec.clusterName, and label-selects server-side.
  Matching against the StackitCluster name breaks for ClusterClass-generated
  infrastructure refs, where the two names always differ.
• Invalid credentials requeue after one minute, so a corrected Secret takes
  effect without another event.
• Reconciler-internal variables renamed for readability (no behavior change); the
  README compatibility table corrected to the v1beta2 contract, which is what
  metadata.yaml, the CRD labels and every import already declare.

Notes

• Breaking changes: none. No API or CRD changes. RBAC gains read access to
  machines.
• Migration: none.
• Tests: an envtest regression test was added for each fix, and every one was
  verified to fail when its fix is reverted. go build ./..., go test ./... and
  golangci-lint run ./... pass; make manifests produces no diff. The e2e suite
  was not run.

[tuunit]

LGTM feel free to merge :)