Resolve the TODO that appears in the generated docs/content/reference/api.md at line 12624: "TODO(dan): document the cloud controller policy".

The docs file is auto-generated by make api-docs, so the TODO originates in the API Go type definitions under api/. The fix must be made in the API type comments, then regenerated with make api-docs.

Why

Users configuring kubeCloudControllerCreds have no documentation on what IAM permissions are required. This forces them to guess or reverse-engineer the required policy, leading to misconfigured clusters or overly permissive credentials.

Acceptance Criteria

• Locate the TODO in the API Go type definition under api/ that produces this generated doc text
• Update the Go type comment to provide a short description or link to documentation of the IAM permissions that kubeCloudControllerCreds must hold
• Cover the required policy for the cloud controller manager
• Remove the TODO comment from the API source
• Run make api-docs to regenerate the documentation

Technical Details

• Generated file: docs/content/reference/api.md line 12624
• Source: API Go type definitions under api/ (find the TODO matching this field)
• TODO text: "TODO(dan): document the 'cloud controller policy'"
• Context: IAM credentials section of the API reference
• Regenerate: make api-docs