[hoalongnatsu]

What does this PR do?

Makes Kubernetes startup understandable and ongoing investigations uninterrupted,
with clearer cluster state and a smoother log-reading experience.

• Prepare once per cluster: start configured clusters at boot and show the
  existing four preparation steps with one progress bar. Progress continues
  while remaining resource types load, rather than falling back to “unknown”.
• Keep working during refreshes: remember first publication across page
  reloads, Versus restarts and credential renewal. Routine refreshes use the
  existing top-bar indicator only; data, filters and open investigations stay
  in place. Genuine failures and stale data remain visible.
• Read live logs continuously: follow Pod, Deployment and StatefulSet output
  across reconnects without oversized resume requests. Open Logs directly from
  resource lists and load earlier output without restarting the live stream.
• Use simpler log controls: select a container, switch between Current and
  Previous, filter messages and jump to the latest line when scrolled up.
  Following resumes automatically at the bottom; no separate Follow toggle is
  needed. Overview log cards stay full width even when the container is quiet.
• Keep resource details out of the way: the drawer overlays the explorer
  without narrowing its lists. Empty crash summaries and unnecessary pagers
  stay hidden.
• Understand cluster state: distinguish missing configuration, unavailable
  credentials, unreadable resource types and failed synchronization. Snapshot
  age is labelled as age, not startup duration. Individual permission gaps are
  visible without blocking readable data.
• Read Secret metadata with the shipped role: the Kubernetes reader now
  includes secrets get/list. Versus uses metadata-only requests and does not
  project Secret values. This is a permission expansion: operators can omit the
  grant from their own role if Secret visibility is unwanted.

Why?

An operator should not lose the explorer to another preparation screen during an
incident, mistake unavailable progress for a cluster failure, or have a live log
read silently stop. The same experience should remain usable on large clusters,
quiet containers and narrow screens.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change (config / API / default behavior)
• Documentation only
• Refactor (no functional change)
• CI / build / chore

The shipped reader role gains read-only Secret access. Review that permission
expansion before applying the updated role to an existing cluster.

Checklist

• Updated user-facing docs under src/ for changed behavior
• Updated ROADMAP.md if this closes a roadmap item
• No secrets, tokens, or webhook URLs introduced in source / YAML
• No new third-party dependencies