Consolidate *bool access helpers into a single IsPublic method

Follow-up from #47.

Right now three spots compute "is this model public" differently:

• operator/internal/controller/reconcilers/auth.go - isPublic(model) local helper.
• operator/internal/controller/reconcilers/routing.go:17 - boolOrDefault(*bool, bool) bool, used for Endpoints.External.Enabled etc. but not Access.Public.
• operator/internal/webhook/v1alpha1/llmmodel_webhook.go:130 - inline Public != nil && *Public inside validateAccess.

Each is correct in isolation; together they are three ways to express the same invariant on the same *bool field. Adding a fourth call site later is a coin flip for which form the author will pick.

Suggested shape

Add a method on the CRD type so both the operator and the webhook import a single source of truth:

// in api/v1alpha1/llmmodel_types.go
func (a AccessSpec) IsPublic() bool {
    return a.Public != nil && *a.Public
}

Then replace the three call sites with model.Spec.Access.IsPublic() and delete the local helper in auth.go.

Placing it on the type also makes it discoverable from the CRD doc and keeps the rule in the package that owns the field.

Start with api/v1alpha1/llmmodel_types.go, then inspect the helper and call sites in operator/internal/controller/reconcilers/auth.go, operator/internal/controller/reconcilers/routing.go, and operator/internal/webhook/v1alpha1/llmmodel_webhook.go. Confirm how each currently handles Access.Public and replace the three forms with the shared method. Done means the local helper and inline logic are removed and all three paths use the CRD method.