Report unsupported external auth types

[3nesdeniz]

Summary

• External-auth references were accepted based on schema validity even when the consuming resource could not execute that auth type. This could leave workloads failing late and could allow affected virtual-MCP backends to lose their intended outgoing-auth configuration during discovery or watch updates.
• Add one consumer compatibility contract for MCPServer, MCPRemoteProxy, VirtualMCPServer, and MCPServerEntry, and surface unsupported or source-invalid configurations through explicit status conditions.
• Keep virtual-MCP routing fail-closed across initial discovery, transient inventory errors, default-auth failures, and dynamic backend updates while preserving healthy peers and valid explicit overrides.
• Make terminal status updates idempotent, clear stale readiness, and update the CRD schema, generated reference documentation, architecture guidance, and examples.

Fixes #5930

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

Verified after rebasing onto the current upstream/main:

• task operator-test (race detector enabled)
• task operator-test-integration (all 11 suites passed)
• Focused task test coverage for converter validation, auth precedence, and invalid-source watcher removal (race detector enabled)
• task operator-generate, task operator-manifests, and task crdref-gen; a second generation pass produced no diff
• git diff --check

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
cmd/thv-operator/pkg/externalauthsupport	Defines and exhaustively tests the consumer/type support matrix.
Operator controllers and status types	Report unsupported or invalid external auth explicitly, avoid terminal retry/status loops, and keep readiness accurate.
pkg/vmcp discovery and watcher paths	Preserve auth precedence and fail closed for excluded, unresolved-default, invalid, or transiently undiscoverable backends.
CRDs, generated references, guides, and examples	Document the compatibility contract and observable status behavior.

Does this introduce a user-facing change?

Yes. Unsupported external-auth combinations now produce an ExternalAuthConfigValidated=False condition with a specific reason and message. Virtual-MCP backends whose outgoing auth cannot be resolved remain excluded instead of being routed without the intended auth, while unaffected backends continue to operate.

Special notes for reviewers

The diff exceeds 1,000 lines because it includes 2,328 added lines of regression/integration tests and 396 added lines of generated CRD/reference artifacts; the production-code portion is 836 added lines. The change remains one cohesive compatibility and fail-closed behavior update for the external-auth consumption paths covered by #5930.

The full root task test was also run. Its remaining failures require a local Docker/Colima runtime for API and Envoy integration cases; all affected packages pass through the focused race-enabled task test command above. task lint reports only the existing G115 warning in cmd/thv/app/upgrade.go:204, which is unchanged from upstream/main.

The most security-sensitive paths are the dynamic backend watcher precedence and deny-list handling, including late-joining backends after default-auth resolution fails.