fix(chart): give flowSchema its doc comment and timings a clean schema entry

deploy/helm/kopiur/README.md

@@ -89,6 +89,7 @@ The 9 CRDs ship in the chart's special `crds/` directory. Helm installs them on
 | imagePullSecrets | list | `[]` | Image pull secrets for the controller pod (concatenated with global.imagePullSecrets; also reaches the webhook pod and mover Jobs). |
 | installScope | string | `"cluster"` | "cluster" (default) or "namespaced".   cluster    — RBAC is a ClusterRole/ClusterRoleBinding. The operator manages     kopiur.home-operations.com resources cluster-wide AND reconciles     ClusterRepository. This is the default because a namespace-scoped Role     silently disables the ClusterRepository kind (a cluster-scoped resource is     out of a Role's reach), turning kopiur into a shared-backup-tier operator     that can't do shared backup tiers.   namespaced — RBAC is a namespace-scoped Role/RoleBinding: the operator     manages resources only in its own namespace and ClusterRepository is NOT     reconciled. Choose this as the explicit least-privilege opt-down for a     single-team install where the reduced blast radius is worth losing     cluster-scoped repositories. |
 | leaderElection | object | `{"enabled":true,"flowSchema":{"enabled":true,"matchingPrecedence":200},"timings":{}}` | Enable leader election. Required when replicaCount > 1; harmless at 1. |
+| leaderElection.flowSchema | object | `{"enabled":true,"matchingPrecedence":200}` | API Priority and Fairness lane for the election Lease. Kubernetes' own `system-leader-election` FlowSchema covers only kube-system ServiceAccounts, so an operator in its own namespace has its lease renewals queued behind all other ServiceAccount traffic in `workload-low` — the congestion behind the controller restart storms in #319. This puts Kopiur's `leases` calls (and only those) into the built-in guaranteed `leader-election` priority level. Turn off if APF is disabled on the cluster or you cannot create cluster-scoped flowcontrol.apiserver.k8s.io objects. |
 | leaderElection.flowSchema.matchingPrecedence | int | `200` | Ordering against other FlowSchemas; lower wins. Must stay above the built-in `system-leader-election` (100) so kube's own controllers keep priority, and below `service-accounts` (9000) or this has no effect. |
 | leaderElection.timings | object | `{}` | Leader-election protocol timings, in seconds. Leave unset to use the client-go defaults (lease 15 / renewDeadline 10 / renewPeriod 2 / retry 2). `renewDeadline` is a budget for a whole ROUND of renew attempts, not one attempt's timeout, and `renewPeriod + renewDeadline` must stay strictly under `leaseDuration` — the operator rejects any other combination at startup rather than risk two replicas both believing they lead. Widen these only if your control plane genuinely cannot answer a lease write inside the default window; prefer leaving `flowSchema` enabled instead. |
 | livenessProbe | object | `{"httpGet":{"path":"/healthz","port":"metrics"},"initialDelaySeconds":10,"periodSeconds":15}` | Liveness probe for the controller container. The whole probe is passed through with `toYaml`, so you can retune timings/thresholds or swap the scheme entirely; set to `{}` to drop the probe. `port: metrics` is the named container port (metrics.port above). |

deploy/helm/kopiur/values.schema.json

@@ -180,7 +180,7 @@
           "type": "boolean"
         },
         "flowSchema": {
-          "description": " leaseDurationSeconds: 15\n renewDeadlineSeconds: 10\n renewPeriodSeconds: 2\n retryPeriodSeconds: 2",
+          "description": "API Priority and Fairness lane for the election Lease. Kubernetes' own\n`system-leader-election` FlowSchema covers only kube-system ServiceAccounts,\nso an operator in its own namespace has its lease renewals queued behind all\nother ServiceAccount traffic in `workload-low` — the congestion behind the\ncontroller restart storms in #319. This puts Kopiur's `leases` calls (and\nonly those) into the built-in guaranteed `leader-election` priority level.\nTurn off if APF is disabled on the cluster or you cannot create\ncluster-scoped flowcontrol.apiserver.k8s.io objects.",
           "properties": {
             "enabled": {
               "default": true,
@@ -199,7 +199,7 @@
           "type": "object"
         },
         "timings": {
-          "description": "API Priority and Fairness lane for the election Lease. Kubernetes' own\n`system-leader-election` FlowSchema covers only kube-system ServiceAccounts,\nso an operator in its own namespace has its lease renewals queued behind all\nother ServiceAccount traffic in `workload-low` — the congestion behind the\ncontroller restart storms in #319. This puts Kopiur's `leases` calls (and\nonly those) into the built-in guaranteed `leader-election` priority level.\nTurn off if APF is disabled on the cluster or you cannot create\ncluster-scoped flowcontrol.apiserver.k8s.io objects.\nLeader-election protocol timings, in seconds. Leave unset to use the\nclient-go defaults (lease 15 / renewDeadline 10 / renewPeriod 2 / retry 2).\n`renewDeadline` is a budget for a whole ROUND of renew attempts, not one\nattempt's timeout, and `renewPeriod + renewDeadline` must stay strictly\nunder `leaseDuration` — the operator rejects any other combination at\nstartup rather than risk two replicas both believing they lead. Widen these\nonly if your control plane genuinely cannot answer a lease write inside the\ndefault window; prefer leaving `flowSchema` enabled instead.",
+          "description": "Leader-election protocol timings, in seconds. Leave unset to use the\nclient-go defaults (lease 15 / renewDeadline 10 / renewPeriod 2 / retry 2).\n`renewDeadline` is a budget for a whole ROUND of renew attempts, not one\nattempt's timeout, and `renewPeriod + renewDeadline` must stay strictly\nunder `leaseDuration` — the operator rejects any other combination at\nstartup rather than risk two replicas both believing they lead. Widen these\nonly if your control plane genuinely cannot answer a lease write inside the\ndefault window; prefer leaving `flowSchema` enabled instead.",
           "required": [],
           "title": "timings",
           "type": "object"

deploy/helm/kopiur/values.yaml

@@ -97,14 +97,6 @@ replicaCount: 1
 # -- Enable leader election. Required when replicaCount > 1; harmless at 1.
 leaderElection:
   enabled: true
-  # -- API Priority and Fairness lane for the election Lease. Kubernetes' own
-  # `system-leader-election` FlowSchema covers only kube-system ServiceAccounts,
-  # so an operator in its own namespace has its lease renewals queued behind all
-  # other ServiceAccount traffic in `workload-low` — the congestion behind the
-  # controller restart storms in #319. This puts Kopiur's `leases` calls (and
-  # only those) into the built-in guaranteed `leader-election` priority level.
-  # Turn off if APF is disabled on the cluster or you cannot create
-  # cluster-scoped flowcontrol.apiserver.k8s.io objects.
   # -- Leader-election protocol timings, in seconds. Leave unset to use the
   # client-go defaults (lease 15 / renewDeadline 10 / renewPeriod 2 / retry 2).
   # `renewDeadline` is a budget for a whole ROUND of renew attempts, not one
@@ -118,6 +110,15 @@ leaderElection:
   #  renewDeadlineSeconds: 10
   #  renewPeriodSeconds: 2
   #  retryPeriodSeconds: 2
+
+  # -- API Priority and Fairness lane for the election Lease. Kubernetes' own
+  # `system-leader-election` FlowSchema covers only kube-system ServiceAccounts,
+  # so an operator in its own namespace has its lease renewals queued behind all
+  # other ServiceAccount traffic in `workload-low` — the congestion behind the
+  # controller restart storms in #319. This puts Kopiur's `leases` calls (and
+  # only those) into the built-in guaranteed `leader-election` priority level.
+  # Turn off if APF is disabled on the cluster or you cannot create
+  # cluster-scoped flowcontrol.apiserver.k8s.io objects.
   flowSchema:
     enabled: true
     # -- Ordering against other FlowSchemas; lower wins. Must stay above the