CRD reference is missing newer fields and condition reasons, and documents fields that do nothing #41

The field names, types, defaults and validation in the CRD reference match v0.1.1. So do the client ID convention, the secret keys, the namespace label and the nebari.dev/force-reprovision annotation. These are missing or wrong:

Missing

• spec.routing.tls.secretName, added in alpha.20 (api/v1/nebariapp_types.go:155-170). The TLS table at docs/site/src/content/docs/nebariapp-crd-reference.md:98-102 lists only enabled.
• spec.landingPage.iconLight / iconDark and the matching status.serviceDiscovery fields, added in v0.1.0 (api/v1/nebariapp_types.go:448-456).
• Condition reasons: UserProvidedSecretReady, UserProvidedSecretNotFound, UserProvidedSecretInvalidType, UserProvidedSecretCheckFailed, CertificateCleanupFailed, BuildFailed. The table at docs/site/src/content/docs/nebariapp-crd-reference.md:212-226 also misses reasons that already existed in alpha.19, including RoutingNotConfigured, TLSDisabled, AuthDisabled and ClusterIssuerNotConfigured, which are the ones a reader hits first when a pack doesn't route.

Documented but not implemented in v0.1.1

• spec.auth.clientSecretRef (docs/site/src/content/docs/nebariapp-crd-reference.md:117): no controller code reads it. The operator always uses <name>-oidc-client (internal/controller/reconcilers/auth/reconciler.go:321).
• status.gatewayRef and status.clientSecretRef (docs/site/src/content/docs/nebariapp-crd-reference.md:234-235) are never written.
• Reasons Available and SecretNotFound are defined but never set.
• landingPage.displayName "required when enabled" isn't enforced, and externalUrl defaults to http:// when TLS is off, not always https://.

Fix

Regenerate the field tables from the v0.1.1 CRD, list every reason the controllers set, and mark the unimplemented fields as such, with upstream issues for each.

Verified against this repo at 4e50cd0, nebari-operator v0.1.1 (same commit as operator main), and NIC v0.14.0.