feat: hot-reload management token

[cxdy]

Related: linode/linode-blockstorage-csi-driver/pull/592

Currently when running latr in daemon mode (including k8s), the token is loaded once at startup and that's it. If the token is rotated, latr won't know until it tries to rotate a token and gets a 401 Invalid Token response from Linode API and fails to rotate tokens.

This PR allows latr to read the secret from a file, cached by default 60s, so that if the token is replaced there's no need to restart, just start using the new token.

[Copilot]

Pull request overview

Adds hot-reload support for the management Linode PAT used by latr in daemon/Kubernetes deployments by introducing a per-request TokenProvider (optionally backed by a file with a short TTL cache), avoiding the need to restart when the PAT rotates.

Changes:

• Introduces TokenProvider + file-backed token reader with TTL caching (LINODE_TOKEN_FILE, LINODE_TOKEN_CACHE_TTL_SECONDS) and wires it into the Linode client via a custom http.RoundTripper.
• Updates cmd/latr startup to select the token provider from env/file and log only the token source (not the token value).
• Updates Helm chart values/templates and README to support mounting the PAT as a file for hot-reload.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Documents token hot-reload env vars and operational behavior.
internal/linode/token.go	Adds token provider abstractions and file-backed token caching + env selection logic.
internal/linode/token_test.go	Adds tests for static/file providers, TTL parsing, env selection, and per-request auth injection.
internal/linode/client.go	Switches client auth to a per-request transport using TokenProvider.
internal/linode/client_test.go	Updates unit tests to reflect new client construction and fields.
helm/latr/values.yaml	Adds chart values for enabling token file mount and cache TTL configuration.
helm/latr/templates/deployment.yaml	Conditionally mounts the token secret as a file and sets env vars accordingly.
cmd/latr/main.go	Replaces one-time LINODE_TOKEN load with TokenProviderFromEnv() and NewClientWithTokenProvider().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.