feat(rotate-ca): add auto-discovery and post-processing (#104)

* feat(rotate-ca): add auto-discovery and post-processing

- Auto-discover control plane and worker nodes from Kubernetes API
- Auto-set --control-plane-nodes and --worker-nodes flags
- Auto-set --output to project talosconfig path
- Auto-set --k8s-endpoint from --endpoints flag
- Post-processing after rotation:
  - Update secrets.yaml with new CA from cluster
  - Update talosconfig.encrypted if exists
  - Update kubeconfig via talm kubeconfig
- Validate only one endpoint/node is provided
- Use endpoint as target node for COSI requests
- Disable --with-docs and --with-examples by default
- Update help text and examples

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

* fix(commands): address review comments

- Check total endpoints + nodes count in rotate-ca validation
- Propagate decryption errors in init.go instead of ignoring them
- Check flag existence with Lookup() before calling Set()
- Handle all Set() errors properly

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

---------

Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: kvaps

pkg/commands/init.go

@@ -324,8 +324,9 @@ var initCmd = &cobra.Command{
 
 		// If encrypted file exists, decrypt it (don't require key - will generate if needed)
 		if encryptedTalosconfigFileExists && !talosconfigFileExists {
-			// If decryption fails (e.g., no key), continue to generate
-			_, _ = handleTalosconfigEncryption(false)
+			if _, err := handleTalosconfigEncryption(false); err != nil {
+				return err
+			}
 			talosconfigFileExists = fileExists(talosconfigFile)
 		}