kubeconfig secret token is very short-lived

**What**
kubeconfig token, which has to be loaded into kubeconfig secret, is very short-lived and needs to get updated every 24h if I want to have coredns setup for a longer period. DNS Operator controller shows unauthorized error after token expires:
```
{"level":"error","ts":"2025-09-21T19:04:49Z","logger":"controller-runtime.cache.UnhandledError","msg":"Failed to watch","reflector":"pkg/mod/k8s.io/client-go@v0.33.3/tools/cache/reflector.go:285","type":"*v1alpha1.DNSRecord","error":"failed to list *v1alpha1.DNSRecord: Unauthorized"}
```

Start by investigating how the kubeconfig secret token is generated and loaded by the DNS Operator controller; the issue provides the controller error and the Kubernetes client-go reflector path as starting points. Done means the controller continues watching DNSRecord resources after the current 24-hour token lifetime without Unauthorized errors.

Written by the indexing model from the issue text.