fix: stop wiping API-key metadata ConfigMap on LLMModel reconcile

[jbouder]

Summary

Fixes #85 — API keys disappearing from the UI.

The key-manager stores key values in the <model>-api-keys Secret (what the gateway authenticates against) and key metadata in the <model>-api-key-metadata ConfigMap (what the UI lists). The LLMModel reconciler applied these two asymmetrically: createOrUpdateSecret deliberately preserves existing.Data, but createOrUpdateConfigMap overwrote existing.Data with the operator's desired data — which for the metadata ConfigMap is an empty placeholder the key-manager is supposed to fill in. So every reconcile of an LLMModel wiped the key metadata, and keys vanished from the UI while continuing to authenticate (the Secret was untouched).

Changes

• Added createOrUpdateConfigMapPreserveData to the LLMModel reconciler — it manages labels only and leaves Data alone, mirroring createOrUpdateSecret and the PassthroughModel reconciler's existing (correct) ConfigMap behavior. The metadata ConfigMap now reconciles through this variant.
• The EPP ConfigMap keeps the original overwriting createOrUpdateConfigMap, since its data is operator-owned config that must propagate on reconcile.
• Added a regression test: reconcile a model, simulate the key-manager writing a key into the Secret and its metadata into the ConfigMap, reconcile again, and assert both survive. Verified the test fails against the previous code and passes with the fix.

Notes

• The PassthroughModel reconciler already preserved ConfigMap data (passthroughmodel_controller.go), so only the LLMModel path needed the fix.
• Full operator suite passes (make test, envtest k8s 1.34).

Screenshots

🤖 Generated with Claude Code