Add BGP teardown cleanup for operator-created Route Server peers before destroy

[paulczar]

Summary

Operator-created VPC Route Server peers sit outside Terraform state. make cluster.<name>.destroy / destroy_force can fail when disassociating the Route Server from the VPC because leftover peers keep endpoints alive.

Context

Seen on the bgp cluster destroy (more than once):

Error: deleting VPC Route Server (...) VPC (...) Association
IncorrectState: Route Server has non-deleted Route Server Endpoint: rse-...

Ownership today:

Resource	Owner
Route Server + endpoints	Terraform (modules/infrastructure/route-server)
Route Server peers	CUDN BGP operator (AWS API via IRSA)

The operator does have cleanup (CUDNBgpConfig finalizer → deleteAllManagedPeers), but cluster destroy often removes the API / skips a clean CR uninstall first, so peers are orphaned. Manual recovery: delete peers → delete endpoints (if needed) → retry destroy.

Acceptance Criteria

• Investigate teardown options (pre-destroy script / Make target vs document-only manual sequence)
• Prefer deleting peers while the cluster API is still up, or via AWS CLI using route_server_id from Terraform state/outputs when the API is gone
• Wire into the destroy path (e.g. make cluster.<name>.teardown-bgp invoked before destroy) or document as a required BGP teardown step
• Update enablement / AGENTS docs with the footgun and recommended destroy order

Related

• PLAN.md / docs/deployment/enablement.md (CUDN BGP / Route Server)
• modules/infrastructure/route-server/
• Operator cleanup path: CUDNBgpConfig finalizer → Cleanup() / deleteAllManagedPeers