Resolve compatibility topics 4-10: Complete webhook design

This commit resolves all remaining compatibility topics between the webhook
design and current backup/restore procedures.

Topic openstack-k8s-operators#4: PVC Labeling Mechanism
- Operators add labels directly when creating PVCs
- Annotation override support: users can override via annotations
- Operators reconcile annotation → label

Topic openstack-k8s-operators#5: Restore Order Granularity
- Separated DataPlane resources into distinct orders:
  NetConfig(5), Reservation(6), IPSet(7), DataPlaneService(8), DataPlaneNodeSet(9)
- Preserves proven restore sequence from current procedure
- Added annotation-based override mechanism for all resources

Topic openstack-k8s-operators#6: User-Provided vs Operator-Managed Resources
- Two complementary labeling approaches:
  1. Webhook labels user-provided resources (no ownerReferences)
  2. Operators directly label resources they create (even with ownerReferences)
- Handles Issuers exception (operator creates with labels, includes custom Issuers)
- No modification of external CRDs needed

Topic openstack-k8s-operators#7: Secrets and ConfigMaps - Which to Backup
- MariaDB password secrets labeled by mariadb-operator
- MariaDBAccount/MariaDBDatabase CRDs get restore annotations
- Password secrets restored in order 1 (before MariaDBAccount in order 4)

Topic openstack-k8s-operators#8: Staged Deployment Annotation
- Use OADP Resource Modifiers to add annotation during restore
- Prevents race condition (annotation added atomically)
- Safe for scheduled backups (no risk to production cluster)

Topic openstack-k8s-operators#9: DataPlane Resources Integration
- DataPlane integrated into unified backup/restore
- Category-based selective restore enables DataPlane-only restore
- Single backup artifact, flexible restore options

Topic openstack-k8s-operators#10: Backup Categories Simplified
- Two categories: controlplane and dataplane
- All user-provided Secrets/ConfigMaps → controlplane
- Network/topology resources → dataplane
- Can add more categories later if needed

All webhook design decisions now align with current proven procedures while
enabling future automation via Golang controller.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: stuggi