Support Kubernetes resource sharding with revision-safe backend endpoints

[haorenfsa]

Behavior

Kubernetes cannot safely use the legacy key-range proxy across independent etcd revision domains. Add an explicit backend mode that transparently forwards one logical etcd cluster per endpoint. kube-apiserver can then shard built-in resources with --etcd-servers-overrides, while retaining each endpoint's native revisions, transactions, leases, watches and compaction.

• Forward KV, Watch, Lease and Maintenance RPCs, including Compact and Status; preserve metadata, headers/trailers and gRPC status.
• Add independently configured listener/backend TLS and mTLS, verified CA/hostname checks, and mutually exclusive backend/shards configuration.
• Preserve large LIST/Watch responses beyond gRPC's default 4 MiB; include 5 MiB response tests.
• Document setup and explicit compatibility limits; add real etcd integration tests and a real dual-backend Kubernetes acceptance harness, with CI for Kubernetes 1.35 and 1.37.

Validation

• Independent agent review completed; receive-limit finding fixed and re-reviewed.
• GitHub Actions unit/race and real Kubernetes 1.35.0 / 1.37.0 jobs all passed on commit 5153f9a9a2d55ae97f99ad6f176832c998a22aec: https://github.com/sharding-db/etcd-sharding-proxy/actions/runs/35342855275
• go test -tags=integration -race ./... and go vet ./... pass locally with etcd 3.6.6. Backend forwarding coverage 91.9%, TLS 100%, configuration 94.2%.
• Real Kubernetes 1.35.0 + two independent etcd 3.6.6 backends + two mTLS proxies: all 12 acceptance checks pass. These cover CRUD/CAS, concurrent pagination snapshots, Watch replay, WatchList bookmarks, CRD CRUD, verified physical Events/default-resource separation, TTL Watch DELETE, compactor markers and proxy/backend restart recovery.
• Go integration independently verifies actual Watch progress and historical Range/Watch errors after Compact, plus lease lifecycle and Status.

Boundaries

This is resource-based sharding through separate endpoints, not transparent global revisions or distributed transactions. CRDs remain on the default backend. Auth/Cluster administration APIs, online migration and a complete Kubernetes conformance/HA soak suite are outside this change. Backend sees the proxy certificate identity; client requests retain the default 4 MiB proxy limit. Test artifacts uploaded by CI contain logs/results only, not test certificates or data directories.