fix: scope ServiceSync service watches

[PKizzle]

Summary

• index LoadBalancer Services by dynamic-prefix.io/name for DynamicPrefix fan-out
• use the index in ServiceSync instead of listing every Service on DynamicPrefix changes
• add optional --service-cache-label-selector and Helm value to narrow the Service informer cache for opt-in deployments
• document labeling HA-managed Services when enabling the cache selector

Testing

• go test ./internal/controller -count=1
• make lint
• make helm-lint

Fixes #20