feat: hot-reload apiToken

[cxdy]

Inspired by linode/linode-cloud-controller-manager#576, adds the ability to store apiToken for hot-reloading the token when rotated.

General:

• Have you removed all sensitive information, including but not limited to access keys and passwords?
• Have you checked to ensure there aren't other open or closed Pull Requests for the same bug/feature/question?

Pull Request Guidelines:

1. Does your submission pass tests?
2. Have you added tests?
3. Are you addressing a single feature in this PR?
4. Are your commits atomic, addressing one change per commit?
5. Are you following the conventions of the language?
6. Have you saved your large formatting changes for a different PR, so we can focus on your work?
7. Have you explained your rationale for why this feature is needed?
8. Have you linked your PR to an open issue

➜  linode-blockstorage-csi-driver git:(feat/hot-reload-token) export DOCKERFILE=Dockerfile.dev IMAGE_VERSION=hot-reload-token
➜  linode-blockstorage-csi-driver git:(feat/hot-reload-token) make docker-build test
DOCKER_BUILDKIT=1 docker build --platform=linux/amd64 --progress=plain \
		-t index.docker.io/linode/linode-blockstorage-csi-driver:hot-reload-token \
		--build-arg REV=hot-reload-token \
		--build-arg GOLANGCI_LINT_VERSION=v2.12.2 \
		-f ./Dockerfile.dev .
#0 building with "desktop-linux" instance using docker driver
#.....
docker run --rm --platform=linux/amd64 --privileged -it index.docker.io/linode/linode-blockstorage-csi-driver:hot-reload-token go test `go list ./... | grep -v ./mocks$` -cover
go: downloading github.com/golang/mock v1.6.0
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
	github.com/linode/linode-blockstorage-csi-driver		coverage: 0.0% of statements
ok  	github.com/linode/linode-blockstorage-csi-driver/internal/driver	0.223s	coverage: 82.2% of statements
	github.com/linode/linode-blockstorage-csi-driver/pkg/cryptsetup-client		coverage: 0.0% of statements
ok  	github.com/linode/linode-blockstorage-csi-driver/pkg/device-manager	0.090s	coverage: 100.0% of statements
	github.com/linode/linode-blockstorage-csi-driver/pkg/filesystem		coverage: 0.0% of statements
	github.com/linode/linode-blockstorage-csi-driver/pkg/hwinfo		coverage: 0.0% of statements
ok  	github.com/linode/linode-blockstorage-csi-driver/pkg/linode-client	0.119s	coverage: 94.2% of statements
ok  	github.com/linode/linode-blockstorage-csi-driver/pkg/linode-volumes	0.105s	coverage: 100.0% of statements
ok  	github.com/linode/linode-blockstorage-csi-driver/pkg/logger	0.079s	coverage: 94.4% of statements
ok  	github.com/linode/linode-blockstorage-csi-driver/pkg/mount-manager	0.106s	coverage: 100.0% of statements
	github.com/linode/linode-blockstorage-csi-driver/pkg/observability		coverage: 0.0% of statements

➜  linode-blockstorage-csi-driver git:(feat/hot-reload-token) go test -v ./pkg/linode-client/...
=== RUN   TestNewLinodeClient
=== RUN   TestNewLinodeClient/Valid_input_without_custom_API_URL
=== RUN   TestNewLinodeClient/Valid_input_with_custom_API_URL
=== RUN   TestNewLinodeClient/Invalid_API_URL
--- PASS: TestNewLinodeClient (0.00s)
    --- PASS: TestNewLinodeClient/Valid_input_without_custom_API_URL (0.00s)
    --- PASS: TestNewLinodeClient/Valid_input_with_custom_API_URL (0.00s)
    --- PASS: TestNewLinodeClient/Invalid_API_URL (0.00s)
=== RUN   TestNewLinodeClientWithTokenProviderNil
--- PASS: TestNewLinodeClientWithTokenProviderNil (0.00s)
=== RUN   TestTokenTransportAuthorization
--- PASS: TestTokenTransportAuthorization (0.00s)
=== RUN   TestTokenTransportUsesProviderError
--- PASS: TestTokenTransportUsesProviderError (0.00s)
=== RUN   TestTokenFileProviderCache
--- PASS: TestTokenFileProviderCache (0.00s)
=== RUN   TestTokenFileProviderEmptyFile
--- PASS: TestTokenFileProviderEmptyFile (0.00s)
=== RUN   TestTokenFileProviderMissingFile
--- PASS: TestTokenFileProviderMissingFile (0.00s)
=== RUN   TestTokenFileCacheTTLFromEnv
=== RUN   TestTokenFileCacheTTLFromEnv/default
=== RUN   TestTokenFileCacheTTLFromEnv/configured
=== RUN   TestTokenFileCacheTTLFromEnv/invalid
=== RUN   TestTokenFileCacheTTLFromEnv/non-positive
--- PASS: TestTokenFileCacheTTLFromEnv (0.00s)
    --- PASS: TestTokenFileCacheTTLFromEnv/default (0.00s)
    --- PASS: TestTokenFileCacheTTLFromEnv/configured (0.00s)
    --- PASS: TestTokenFileCacheTTLFromEnv/invalid (0.00s)
    --- PASS: TestTokenFileCacheTTLFromEnv/non-positive (0.00s)
=== RUN   TestTokenProviderFromFileOrEnv
=== RUN   TestTokenProviderFromFileOrEnv/uses_file_when_available
=== RUN   TestTokenProviderFromFileOrEnv/falls_back_to_env_when_file_missing
=== RUN   TestTokenProviderFromFileOrEnv/errors_when_both_unavailable
--- PASS: TestTokenProviderFromFileOrEnv (0.00s)
    --- PASS: TestTokenProviderFromFileOrEnv/uses_file_when_available (0.00s)
    --- PASS: TestTokenProviderFromFileOrEnv/falls_back_to_env_when_file_missing (0.00s)
    --- PASS: TestTokenProviderFromFileOrEnv/errors_when_both_unavailable (0.00s)
=== RUN   TestStaticTokenProvider
--- PASS: TestStaticTokenProvider (0.00s)
PASS
ok  	github.com/linode/linode-blockstorage-csi-driver/pkg/linode-client	(cached)

Continuation of #591 - CI doesn't like my fork ☹️

[codecov]

Codecov Report

❌ Patch coverage is 85.05747% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.51%. Comparing base (56c8437) to head (7e86c10).

Files with missing lines	Patch %	Lines
main.go	0.00%	7 Missing ⚠️
pkg/linode-client/token.go	93.10%	2 Missing and 2 partials ⚠️
pkg/linode-client/linode_client.go	90.90%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #592      +/-   ##
==========================================
+ Coverage   70.93%   71.51%   +0.57%     
==========================================
  Files          24       25       +1     
  Lines        2164     2243      +79     
==========================================
+ Hits         1535     1604      +69     
- Misses        500      507       +7     
- Partials      129      132       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds support for hot-reloading the Linode API token (PAT) by reading it from a mounted Secret file with a short TTL cache, enabling token rotation without restarting the CSI controller. It updates the Linode client authentication flow to inject the bearer token per HTTP request via a TokenProvider, and wires Helm/kustomize deployment options and documentation to support the file-mount mode.

Changes:

• Introduces a token abstraction (TokenProvider) plus file-backed token loading with TTL caching and env fallback (pkg/linode-client/token.go), with unit tests.
• Updates Linode client creation to authenticate per-request using a custom HTTP transport, enabling token hot-reload without rebuilding the client.
• Adds Helm chart + deployment manifest options/docs for mounting the token Secret as a file and configuring the token file path/TTL.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/linode-client/token.go	Adds token providers (static + file-backed w/ TTL cache) and selection logic from file/env.
pkg/linode-client/token_test.go	Unit tests for token providers, cache behavior, and env/file selection.
pkg/linode-client/linode_client.go	Switches auth to per-request token injection via a custom RoundTripper.
pkg/linode-client/linode_client_test.go	Adds tests validating per-request Authorization and error behavior.
main.go	Uses token providers to build the Linode client and logs token source for controller mode.
helm-chart/csi-driver/values.yaml	Documents new secretRef.mountSecret / secretRef.mountPath options and updates examples.
helm-chart/csi-driver/templates/csi-linode-controller.yaml	Adds conditional token Secret mount + LINODE_API_TOKEN_FILE wiring for hot-reload mode.
docs/deployment.md	Documents how to enable hot-reload token mode via Helm and what behavior to expect.
deploy/kubernetes/base/ss-csi-linode-controller.yaml	Adds commented opt-in blocks for file-mounted token mode in raw manifests.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.