Replace github.com/pkg/errors with fmt.Errorf and %w to preserve error
chains for upstream classification by ctrlerrors.HandleError.

Kong client:
- Enhance apiError with IsRetryable/IsBlocked/RetryDelay duck-typing
  so errors propagate correctly through the controller error handler
- Add 429 Too Many Requests handling with retry delay
- Include HTTP status codes in all error messages for debuggability
- Add IsNotFound helper and comprehensive tests

Secret-manager API:
- Wrap network errors as retryable, 401 as blocked
- Add handleError classifier that distinguishes retryable 4xx (408/429)
  from blocked 4xx and retryable 5xx

Also fix consumer handler error message typo ("route" -> "consumer")
and add context to last-mile-security secret resolution errors.

Introduce RouteOverwrite on RealmSpec to allow per-route control of
identity routes (issuer, certs, discovery). Each overwrite can disable
a route or prepend a custom path prefix to the downstream path.

- Move RouteType enum from handler to gateway API for cross-module use
- CreateRoute returns nil when a route is disabled via overwrite
- Realm handler now cleans up orphaned Route objects via gc.Cleanup
- Add owner index on Route for cleanup lookups
- Handle nil route returns in createRoutes by clearing status fields

When a zone has Visibility=World, populate RouteOverwrites on the
gateway realm with /spacegate prefix for issuer, certs, and discovery
routes. This keeps the actual IDP unexposed on internet-facing gateways
by proxying identity endpoints under a common prefix.

- Enterprise zones get no route overwrites (tested)
- Update Zone CRD: rename routes->realm, drop minItems constraint
- Update existing zone controller tests with expected RouteOverwrites

Label managed routes with the Zone's owner UID and use OwnedByLabel
with the JanitorClient to clean up routes that were not created or
updated during reconciliation. This handles both the case where routes
are modified and where managed routes are removed from the spec entirely.

OwnedByLabel is used instead of OwnedBy because routes live in a
different namespace than the Zone CR, preventing cross-namespace
controller references.