feat: add DM (Data Migration) support

[tennix]

Summary

• Add CRD API types for DMGroup, DM, DMWorkerGroup, DMWorker with TLS support from the start
• Add runtime/scope types and config packages (pkg/configs/dm, pkg/configs/dmworker) for dm-master and dm-worker
• Add four controllers following the Group+Instance pattern:
  • DMGroup: manages dm-master replicas with embedded etcd bootstrap, headless + internal service, rolling update
  • DM: dm-master instance controller with health check (GET /api/v1/cluster/info), ConfigMap, DataVolume PVC, pod lifecycle
  • DMWorkerGroup: manages dm-worker replicas with headless service, maxSurge=0/maxUnavailable=1 for pod name stability
  • DMWorker: dm-worker instance controller with health check (GET /status), ConfigMap, RelayVolume PVC, pod lifecycle
• Register all controllers in cmd/tidb-operator/main.go
• Add example manifests examples/basic/07-dm.yaml and examples/basic/08-dmworker.yaml

Architecture notes

• Bootstrap: dm-master uses AnnoKeyInitialClusterNum annotation on instances to compute initial-cluster; TaskBoot removes the annotation once all initial instances are ready. Bootstrap state is derived from existing instances (absence of annotation = bootstrapped).
• dm-worker join: join address is derived from <DMGroupRef.Name>-dm-master internal service at the default DM port (8261).
• Pod name stability: DMWorker uses maxSurge=0, maxUnavailable=1 to preserve pod names required by dm-master's lastBound etcd history.
• No PD dependency: dm-master uses embedded etcd only; no PDClientManager needed.

Test plan

• Apply examples/basic/07-dm.yaml — verify DMGroup creates headless + internal service and DM pods
• Verify dm-master bootstrap: AnnoKeyInitialClusterNum annotation removed after all initial replicas ready
• Apply examples/basic/08-dmworker.yaml — verify DMWorkerGroup creates headless service and DMWorker pods
• Verify dm-worker joins dm-master via <dmgroup>-dm-master service
• Scale DMGroup replicas 1→3 — verify join mode used for new instances (no boot annotation)
• Scale DMWorkerGroup replicas 1→3 — verify rolling update with maxUnavailable=1
• Verify TLS: enable spec.tlsCluster on Cluster, confirm TLS mounts appear in pods
• Delete DMGroup — verify all DM instances and services are cleaned up

🤖 Generated with Claude Code

[ti-chi-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign cofyc for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 1571 lines in your changes missing coverage. Please review.
✅ Project coverage is 35.16%. Comparing base (2b81667) to head (c45afd3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6883      +/-   ##
==========================================
- Coverage   37.44%   35.16%   -2.28%     
==========================================
  Files         392      427      +35     
  Lines       22432    24054    +1622     
==========================================
+ Hits         8399     8458      +59     
- Misses      14033    15596    +1563     

Flag	Coverage Δ
unittest	35.16% <0.00%> (-2.28%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.