feat: queue-operator auto-registers Temporal namespace before creating TemporalWorker

A Queue's temporal.io/namespace label was trusted as-is -- if the referenced
Temporal namespace was never registered (or typo'd), the failure only
surfaced as a worker pod silently polling a namespace that doesn't exist.
Now reconcileTemporalWorker calls RegisterNamespace (idempotent, ignores
AlreadyExists) via a direct WorkflowService gRPC client before creating the
TemporalWorker, so namespace and worker always come into existence together.

Also grant queue-operator's ClusterRole create/delete on temporalworkers
(previously missing, causing forbidden errors on the create-then-delete path).

cmd/queue-operator/main.go

@@ -23,6 +23,7 @@ import (
 	kmsvcv1 "github.com/rockliang/kafka-management-service/apis/kmsvc/v1"
 	"github.com/rockliang/kafka-management-service/internal/kafka"
 	"github.com/rockliang/kafka-management-service/internal/operator"
+	kmsvctemporal "github.com/rockliang/kafka-management-service/internal/temporal"
 )
 
 func main() {
@@ -66,11 +67,17 @@ func main() {
 		exitf("connecting to redis at %s: %v", redisAddr, err)
 	}
 
+	temporalClient, err := kmsvctemporal.NewClient(getEnv("KMSVC_TEMPORAL_FRONTEND_ADDRESS", "temporal-frontend.temporal.svc.cluster.local:7233"))
+	if err != nil {
+		exitf("creating temporal client: %v", err)
+	}
+
 	reconciler := &operator.QueueReconciler{
-		Client: mgr.GetClient(),
-		Admin:  admin,
-		Redis:  rdb,
-		Now:    time.Now,
+		Client:   mgr.GetClient(),
+		Admin:    admin,
+		Redis:    rdb,
+		Now:      time.Now,
+		Temporal: temporalClient,
 		Zones: &operator.ZoneLocator{
 			// GetAPIReader(), not GetClient(): the latter is cache-backed and
 			// would make controller-runtime List+Watch all Pods/Nodes