Replace released HCloud setup loader with generic cnap resources

[robinbraemer]

Replace the released product-specific HCloud setup path with a generic, secret-safe akua hcloud setup flow.\n\n- Remove the dedicated route, client contract, naming, tests, and docs without compatibility support.\n- Preflight HCloud locally without provisioning or spend.\n- Persist only through generic cloud_provider/hcloud secrets and BYOM compute configs, retaining the initial secret-version ID.\n- Keep retries, re-entry, and compensation ownership-safe.\n\nRelated cnap history: https://github.com/akua-dev/cnap/issues/540

[akua-agentos]

Production evidence shows this issue is still live.

• Current reviewed release: akua v0.9.0 from source 6c12ac1d349e28ee9e16af831cb6582bf05a2ede.
• Its only HCloud setup command remains akua agent-os load-hcloud-provider, fixed to POST /v1/agent_os/hcloud_provider_loads.
• cnap removed that route in #546 (2f37c5c) after CLI PR feat(hcloud): replace product-specific loader with generic setup #26 introduced the intended generic akua hcloud setup path.
• CLI PR revert: restore pre-#26 CLI interface #28 then reverted feat(hcloud): replace product-specific loader with generic setup #26 back to the product-specific command, but this issue stayed closed and no replacement release was published.
• A real protected-file invocation against the dedicated Agent OS workspace returned sanitized HTTP 404. The client did not retry, no provider write succeeded, and no credential material was printed or retained.

Please restore the generic secret-safe setup flow (or another reviewed native Akua replacement), release it immutably, and include a production route-contract smoke so a CLI release cannot target a removed API endpoint.