fix: wait for system API readiness

[miki3421]

Summary

• add a TCP readiness probe to the Nuvolaris system API StatefulSet
• keep the Service endpoint unavailable until the admin API listener accepts connections
• make kubectl rollout status reflect application readiness before SSO login attempts

Validation

• rendered manifest accepted by kubectl apply --dry-run=client
• live rollout in the Lima Kind cluster completed with the probe
• openserverless-testing/tests/11-sso-mock.sh kind completed with exit code 0