apiserver: replace sample-apiserver and add integration coverage

[dilyevsky]

Summary

• replace the sample-apiserver startup path with a local Tilt-style server builder/start flow under pkg/apiserver/server
• wire pkg/apiserver/manager.go and storage to the new server path, including configurable bind address/port and local readyz/client handling
• add end-to-end pkg/apiserver integration tests for health, CRUD + sqlite persistence, simple auth, and defaulter/validator hooks

Review Guide

1. pkg/apiserver/server/ for the new local apiserver builder/start implementation
2. pkg/apiserver/manager.go for server boot, auth wiring, and the removal of the sample-apiserver command wrapper
3. pkg/apiserver/storage.go for the Kine listener/metrics changes needed for repeatable in-process starts
4. pkg/apiserver/integration_test.go for the new coverage

Details

• preserves shared storage across versions and keeps status subresource wiring in the local builder
• removes the old flag reset / command shim path from manager startup
• fixes custom cert-path handling in start() by avoiding local variable shadowing
• uses a unique Kine unix socket directory per process and wraps metric registration per instance so multiple in-process starts do not panic
• makes the local client and readiness probe target the configured loopback host/port instead of hardcoding localhost:8443

Tests

• go test ./pkg/apiserver -run TestAPIServerIntegration -count=1
• go test ./pkg/apiserver/... -count=1
• go build ./cmd/apiserver

Notes

• the simple-auth path currently propagates the username reliably; anonymous fallback comes through as system:anonymous with system:unauthenticated, and the integration test asserts that current behavior
• sqlite/Kine still emits dbstat warnings during startup in this environment; that is pre-existing runtime noise and not addressed here