[feat] CRD support for Valkey 9.1 database-level ACL permissions (db=)

[jdheyburn]

Problem

Valkey 9.1 introduced database-level ACL permissions, allowing a user's access to be scoped to specific logical database indices. The full set of directives is:

• db=<id>[,<id>...] — restrict the user to the listed database IDs
• alldbs — allow the user to access all databases (default for new users)
• resetdbs — clear all allowed databases and the alldbs flag; user cannot access any database until db= or alldbs is re-added

The current UserAclSpec in valkeyacls_types.go has no Databases field. Users who need db= scoping today must use the permissions (raw ACL) escape hatch, which gives up the structured API and validation.

Proposed fix

Add a DatabasesAclSpec struct and a Databases field to UserAclSpec, following the same pattern as KeysAclSpec and ChannelsAclSpec:

type DatabasesAclSpec struct {
    // Specific database IDs the user is allowed to access.
    // Maps to Valkey: db=0,1,2
    // +optional
    IDs []int `json:"ids,omitempty"`

    // Allow the user to access all databases. Default for new users.
    // Maps to Valkey: alldbs
    // +kubebuilder:default=false
    AllDbs bool `json:"allDbs,omitempty"`

    // Clear allowed databases and the alldbs flag.
    // Maps to Valkey: resetdbs
    // +kubebuilder:default=false
    ResetDbs bool `json:"resetDbs,omitempty"`
}

buildUserAcl in internal/controller/users.go must be updated to emit the db= clause (or alldbs/resetdbs) when Databases is set.

Version requirement

db= ACL directives require Valkey 9.1+. The operator should guard this at reconcile time (ideally via a shared version-gating framework once that exists). If the detected version is < 9.1 and a user spec includes Databases, the operator should surface a condition warning rather than silently ignoring the field.

Acceptance criteria

• DatabasesAclSpec added to valkeyacls_types.go; Databases field added to UserAclSpec
• buildUserAcl emits db=<id>[,<id>...] / alldbs / resetdbs correctly
• CRD validation: IDs and AllDbs/ResetDbs are mutually exclusive where appropriate
• Version gate: condition warning if Databases is set on a cluster running < 9.1
• Unit tests for buildUserAcl with all three directives
• E2E test: create a user with db=0; verify ACL LIST on the pod reflects the restriction

References

• Valkey 9.1 ACL docs (database permissions)
• Existing pattern: KeysAclSpec, ChannelsAclSpec in valkeyacls_types.go
• buildUserAcl in internal/controller/users.go

[jdheyburn]

Implementation note: shared runtime version detection and gating for features above the 9.0 baseline is tracked in #263. When landing Databases / db= ACLs, prefer wiring the 9.1+ check through that framework (or land #263 first) so version handling stays consistent across the operator.