Proposal: configurable service DNS domain

## Problem

The operator hardcodes `svc.cluster.local` when building member FQDNs and the default cert SANs. The string appears in `internal/controller/pods.go`, `internal/controller/utils.go`, and `pkg/certificate/interfaces/interface.go` (`DefaultDomainName`).

Any k8s cluster whose apiserver was started with a non-default `--service-dns-domain` (common in self-hosted / air-gapped / k3s / kubeadm
deployments) is broken at first reconcile:
- Pods advertise `--advertise-*-urls` containing `cluster.local`, which
CoreDNS does not resolve.
- Server cert SANs are `*...svc.cluster.local`, so peer mTLS
handshakes fail `checkCertSAN` and the cluster never forms.

## Proposed fix

The service DNS domain is a property of the *cluster*, not of any individual `EtcdCluster`, so the primary knob should be an operator-level flag:
- Add `--cluster-domain` to `cmd/main.go`, default `cluster.local`.
- Wire it onto `EtcdClusterReconciler` (same pattern as `ImageRegistry`).
- Resolve the suffix everywhere a member URL or cert SAN is built: `clientEndpointForOrdinal`, `defaultArgs`, `peerEndpointForOrdinalIndex`, `createCMCertificateConfig`, `createAutoCertificateConfig`.
- Stop referencing `certInterface.DefaultDomainName` from the controller (keep the constant for backward compatibility, but mark deprecated).

Optional follow-up (not required for the fix): an `EtcdClusterSpec.dnsDomain` override for the rare case of one operator spanning multiple suffix domains or for staged migration.

## Why not just a CRD field

A per-`EtcdCluster` field works, but every cluster then has to repeat the value the operator already knows. A flag matches the one-operator-per-cluster deployment shape and keeps the existing manifest examples unchanged (default remains `cluster.local`).

## Acceptance criteria

- Operator runs unchanged on a `cluster.local` cluster.
- Operator runs on a cluster with `--service-dns-domain=corp.local` when started with `--cluster-domain=corp.local`: Pods advertise and serve on `*.svc.corp.local`, cert SANs match, TLS peer/client handshakes succeed.
- Unit tests assert the domain is honored; e2e test passes on a non-default suffix.
- Existing CRD examples and docs need updates.

Start in cmd/main.go and follow the ImageRegistry wiring onto EtcdClusterReconciler. Then inspect clientEndpointForOrdinal, defaultArgs, peerEndpointForOrdinalIndex, createCMCertificateConfig, and createAutoCertificateConfig in the named controller and certificate files, along with the existing unit and e2e tests. Done means the configurable suffix is used for member URLs and certificate SANs, tests cover it, and examples and docs are updated.

Written by the indexing model from the issue text.