Support optional replica distribution across architectures

Connect, Workbench, and Package Manager have no way to control how their
server replicas are spread across topology domains — only a hardcoded,
soft hostname anti-affinity exists (ComponentSpecPodAntiAffinity in
shared.go).

This blocks running a single multi-arch Site (amd64 + arm64) with a
guaranteed one-replica-per-architecture split, needed for the images EKS
living-environment work in platform-infra.

Add an optional topologySpreadConstraints field to each product spec,
passed through to the server Deployment, so operators can opt in to a
hard spread (e.g. maxSkew: 1, whenUnsatisfiable: DoNotSchedule by
kubernetes.io/arch) without affecting existing installations.