Feature: on-demand EtcdBackup CR — snapshot to object storage (S3/GCS, pluggable)

## Summary

Implement the roadmap item **"Create on-demand backup of a cluster"** ([docs/roadmap.md](https://github.com/etcd-io/etcd-operator/blob/main/docs/roadmap.md)) via a new namespaced `EtcdBackup` CRD that takes a point-in-time etcd snapshot and uploads it to an object store.

## Proposed design

- **New CRD `EtcdBackup`** (`operator.etcd.io/v1alpha1`): spec references an `EtcdCluster` + a destination `{provider: s3|gcs, bucket, prefix, region, secretRef}` with optional retention; status reports `phase`, `snapshotLocation`, `snapshotSizeBytes`, `completionTime`, and a `Succeeded` condition.
- **Controller** snapshots a healthy member (`etcdctl snapshot save` streamed via the Kubernetes exec subresource) and uploads it, streaming through an `io.Pipe` for bounded memory.
- **Provider isolation**: the cloud SDKs (`aws-sdk-go-v2`, `cloud.google.com/go/storage`) live behind a `pkg/objectstore.Store` interface with a `Factory` registry. S3 (incl. S3-compatible via custom endpoint + path-style) and GCS are implemented; new backends register themselves. The controller imports no cloud SDK directly, so the code is liftable into a standalone `cmd/backup-manager` later if the core operator's CVE surface becomes a concern.
- **Credentials**: `secretRef` is optional; absent it falls back to ambient credentials (IRSA / Workload Identity), the recommended production posture.

## Scope / follow-ups

In scope: on-demand backup, S3 + GCS providers, retention pruning, unit/envtest coverage, a compile-only MinIO-backed e2e, sample CRs, docs.

Deferred (foundation laid by this work): restore (`new cluster from a backup`), scheduled/periodic backups (`EtcdBackupSchedule`), and mTLS cert-flag injection for the snapshotter.

I have an implementation ready and will open a PR referencing this issue.

Start with docs/roadmap.md, then review the proposed pkg/objectstore.Store and Factory boundary and the future cmd/backup-manager entry point. Validate the stated unit and envtest coverage, compile-only MinIO-backed e2e, sample CRs, and documentation. Done means on-demand S3/GCS snapshots, retention pruning, status reporting, and the listed coverage are present.

Written by the indexing model from the issue text.