TLS: etcd runs cleartext — URLs hardcoded to http:// and no TLS flags emitted

### Problem

Even when certificates are provisioned (and mounted), etcd is started in **cleartext**:
- `defaultArgs` hardcodes `http://` on the listen/advertise/peer URLs (`internal/controller/utils.go:82-85`) and emits no TLS flags.
- the endpoint generators hardcode `http://` (`peerEndpointForOrdinalIndex` `:425`, `clientEndpointForOrdinalIndex` `:481`, `clientEndpointsFromStatefulsets` `:495`).

So `spec.tls` provisions certs that are never used by the data path.

### Proposed change

When `spec.tls != nil`: switch the URL scheme to `https://` and append `--cert-file`/`--key-file`/`--trusted-ca-file`/`--peer-cert-file`/`--peer-key-file`/`--peer-trusted-ca-file`/`--client-cert-auth`/`--peer-client-cert-auth` (pointing at the mounted paths). Crucially, derive the scheme from a **single source of truth** shared by both the etcd args and every endpoint generator, so the operator's computed endpoints can never disagree with the scheme etcd actually serves.

Unit tests assert the `tls == nil` path is byte-identical to today (no regression for existing cleartext clusters) and the `tls != nil` path emits the expected flags + `https://`.

### Note on migration

TLS is treated as a **create-time** property: this targets standing up a *new* TLS-enabled cluster, not live-flipping a running cleartext cluster (a member-by-member peer-TLS roll is a separate, harder problem). Depends on the cert-mount change (mounts must land first, or etcd crashloops referencing unmounted files). PR to follow.

Start in internal/controller/utils.go at defaultArgs and the endpoint generators peerEndpointForOrdinalIndex, clientEndpointForOrdinalIndex, and clientEndpointsFromStatefulsets. Compare the tls == nil and tls != nil paths, including the cert-mounted paths from the dependent mount change. Done means cleartext output remains byte-identical, while TLS output uses https:// and emits all requested client and peer TLS flags in unit tests.

Written by the indexing model from the issue text.