feat: stamp the build commit, add --version and zap flags, rename module

- module path is now gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator
- internal/version resolves the commit from ldflags or Go build info;
  --version prints it and the first log line carries it
- --metrics-bind-address is passed to the manager instead of being dropped
- Dockerfile takes GIT_COMMIT, honours TARGETARCH, labels the image revision

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/flows.md

@@ -52,11 +52,8 @@ process start
          ├─ ctrl.GetConfigOrDie()       # KUBECONFIG or in-cluster config
          │      on err ──► os.Exit(1)
          │
-         ├─ ctrl.NewManager(cfg, Options{Scheme, HealthProbeBindAddress: ":8081"})
+         ├─ ctrl.NewManager(cfg, Options{Scheme, Metrics, HealthProbeBindAddress})
          │      on err ──► log + os.Exit(1)                            [main.go:44-47]
-         │      NOTE: metricsAddr is parsed above but NOT passed here;
-         │            the manager falls back to its own default, which
-         │            is also ":8080" (see §10, item 2)
          │
          ├─ controller.SetupCertificateReconciler(mgr)                  [main.go:53]
          │      registers field index + watches (see §3)
@@ -469,8 +466,8 @@ Recorded as-found. None are fixed by this document.
 **1. `AnnotationListenerPort` is dead code**
 `certificate_controller.go:25` declares the constant; `BuildListenersFromCertificates` (`patch.go:44`) always uses `defaultPort = 443`. Setting `gateway-cert-operator.io/listener-port` on a Certificate has no effect.
 
-**2. `--metrics-bind-address` flag is parsed but not wired**
-`main.go:32` parses the flag; `main.go:44-47` never passes `MetricsBindAddress` to `ctrl.Options`. controller-runtime defaults an empty bind address to `:8080`, so metrics are served and the Service in `deploy/service_gateway-cert-operator-metrics.yaml` works; only changing the flag has no effect.
+**2. `--metrics-bind-address` flag was not wired** (fixed)
+The flag used to be parsed and dropped; metrics were served anyway because controller-runtime defaults an empty bind address to `:8080`. `main.go` now passes it through `metricsserver.Options`.
 
 **3. No finalizer → cert deletion leaves stale listeners**
 When a Certificate is deleted, Reconcile returns early at branch (A) with no cluster write. The stale `auto-*` listener persists in the Gateway until a sibling event triggers re-convergence (see Scenario 4 above), or permanently if no other Certificate targets that Gateway. Adding a finalizer to the Certificate would close this gap by allowing cleanup before the object is removed from the API server.