Shared spec and status

All token CRDs embed a common base spec and status; per-source specs add their own fields on top.

spec:
  rotationSchedule: "0 0 1 * *"    # cron
  forceNow: false
  rotationStrategy: Immediate       # Immediate | KeepOld
  apiTokenSecretRef:                # the credential the controller uses to mint
    name: gitlab-api-credentials
    key: token
  export:
    type: Secret
    name: gitlab-ci-token
    namespace: default
  # source-specific fields:
  project: mygroup/myproject
  accessLevel: Maintainer
  scopes: [api, read_registry]

status:
  conditions: [...]
  lastRotationTime: ...
  nextRotationTime: ...
  currentTokenRef: {name: ..., namespace: ...}

The shared types live in api/v1alpha1/tokenbase_types.go. Shared behavior (schedule parsing, condition helpers, export) lives in internal/rotation/.

No TokenSource interface: the specs vary too much to abstract usefully. Each per-source reconciler calls its concrete client directly.