feat: 'kportal generate' subcommand to bulk-add forwards from a cluster

New subcommand that connects to a chosen kube context and walks the
user through three picker steps before writing forwards to the config:

  1. Namespace multi-select (no system-namespace exclusion)
  2. Service multi-select grouped by namespace, with already-configured
     rows greyed out and locked off
  3. Starting-port input with a live preview of consecutive local-port
     assignments, skipping any port already taken by the existing config
     or another row in the batch

Multi-port services emit one forward per port. Non-TCP ports are
skipped with a one-line warning at the end (kportal forward layer is
TCP-only). --dry-run prints the planned forwards without writing.

Subcommand dispatch lives in cmd/kportal/main.go: when os.Args[1] ==
'generate', runGenerate(os.Args[2:]) is invoked before the main
flag.Parse() so the flag.NewFlagSet 'generate' parses its own
'--context', '--config', '--dry-run' flags. Invalid contexts list
the available ones for quick correction.

Tests in internal/ui/generate_test.go cover:
  - namespace toggle / toggle-all / filter
  - service multi-select with locked already-configured rows and
    non-TCP filtering
  - port-collision-aware consecutive assignment using a real Mutator
    against a tempdir config
  - reject + recover for starting-port < 1024
  - dry-run does not invoke the mutator
  - end-to-end Update() walk through the three steps
  - parse-starting-port boundary table
  - port-step view rendering
  - ServiceCandidate.Key() determinism

README updated with a 'Generate Forwards from a Cluster' section
describing the flow and the three flags.

cmd/kportal/main.go

@@ -68,6 +68,13 @@ func promptCreateConfig(path string) bool {
 }
 
 func main() {
+	// Subcommand dispatch. Must run BEFORE flag.Parse() because the global flag
+	// set is reused from here and we don't want generate-specific flags to be
+	// rejected as unknown by the main flag set.
+	if len(os.Args) >= 2 && os.Args[1] == "generate" {
+		os.Exit(runGenerate(os.Args[2:]))
+	}
+
 	flag.Parse()
 
 	if *showVersion {