Support downloading multi-cluster kubeconfig files with TTL and using kubectl through the Cluster Agent proxy.

[TimeBye]

Summary

• Add secure kubeconfig downloads for user-authorized clusters.
• Add revocable, stateful kubeconfig tokens with expiration, usage tracking, and user/admin management APIs.
• Add an authenticated Kubernetes API proxy that validates token, cluster access, and RBAC permissions for every request.
• Add kubeconfig download and token-management UI, including cluster filtering, bulk selection, TTL presets/custom expiry, and automatic cluster refresh without closing the dialog.
• Add Helm configuration for dedicated kubeconfig token signing secrets and English/Chinese documentation.
• Add E2E coverage for the kubeconfig download workflow.

Why

Users need a safe way to download kubeconfig files for selected clusters without exposing permanent credentials. Stateful tokens provide expiration and revocation, while the proxy enforces Kite authorization for Kubernetes API access.

Related issue

Closes #695

Validation

• go test ./...
• git diff --check
• Added backend unit tests for token lifecycle, kubeconfig download, token management, and proxy authorization.
• Added UI component tests for the download dialog and token-management views.
• Added Playwright E2E coverage for the kubeconfig download workflow.
• E2E was not run locally because kind is unavailable in the environment.

Checklist

• I reviewed this PR myself before requesting review.
• I understand the changes, including AI-generated parts (if any).
• For new features, a feature request issue is linked.
• I cleaned up AI noise (unnecessary comments, dead code, and unrelated changes).
• This PR is reasonably scoped (or split into smaller PRs).