Operator silently swallows the client-certificate provisioning error

### Problem

In `fetchAndValidateState` (`internal/controller/etcdcluster_controller.go:138`), a failure from `createClientCertificate` is logged and then **swallowed** — the reconcile proceeds as if the client certificate exists. When provisioning genuinely fails (issuer not ready, RBAC, transient API error), the operator continues without a usable client cert, the error never surfaces in status, and any subsequent cert-dependent operation fails downstream with a less obvious symptom.

### Proposed fix

On `createClientCertificate` failure, requeue with backoff (`ctrl.Result{RequeueAfter: ...}`) instead of logging-and-proceeding, so provisioning is retried and the cluster converges once the issuer is ready.

Small, self-contained change (~8 lines) with a unit test (fake client fails the Certificate create → assert requeue, not proceed). I'd like to send a PR for this.

Start in internal/controller/etcdcluster_controller.go at fetchAndValidateState around line 138, and trace how createClientCertificate errors are handled. Add the unit test described with a fake client that fails Certificate creation, then verify the reconcile result requeues instead of proceeding and that the existing success path remains intact.

Written by the indexing model from the issue text.