fix: use correct QUARKUS_OPERATOR_SDK_NAMESPACES env var for operator namespace watch

WATCH_NAMESPACES is not a JOSDK env var. The Quarkus JOSDK extension reads
QUARKUS_OPERATOR_SDK_NAMESPACES (maps to quarkus.operator-sdk.namespaces).

Also: update CNPG anti-affinity topology key from kubernetes.io/hostname to
topology.kubernetes.io/zone to spread primary and replica across pve-1 / pve-2.

manifest/operator/kustomization.yaml

@@ -16,9 +16,11 @@ resources:
   - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.2.5/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
   - https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.2.5/kubernetes/kubernetes.yml
 
-# Patch the operator Deployment to watch the 'login' namespace in addition to
-# keycloak-system. WATCH_NAMESPACES="" means all namespaces; a comma-separated
-# list restricts to those namespaces. Using "login" here is explicit and safe.
+# Patch the operator Deployment so it reconciles CRs in the 'login' namespace.
+# The Keycloak Operator uses Quarkus JOSDK — the correct env var is
+# QUARKUS_OPERATOR_SDK_NAMESPACES (maps to quarkus.operator-sdk.namespaces).
+# A comma-separated list, or "*" for all namespaces. The operator already has
+# ClusterRoles so it has the RBAC to watch any namespace.
 patches:
   - target:
       group: apps
@@ -29,5 +31,5 @@ patches:
       - op: add
         path: /spec/template/spec/containers/0/env/-
         value:
-          name: WATCH_NAMESPACES
+          name: QUARKUS_OPERATOR_SDK_NAMESPACES
           value: "login"