Fix Azure node-policy apply failures, resync API surface, align v1/v2 fields, add CRUD test harness

[Tzvonimir]

What?

Fixes the customer-reported v0.1.6 failure where devzero_node_policy with azure {} and/or taints errored during apply ("Struct defines fields not found in object: kubelet" / "can't unmarshal into *provider.Taint, needs FromTerraform5Value method"), then brings the whole provider back in line with the current DAKR API: proto resync, removal of three HPA fields the backend deleted, NotFound handling in every Read/Delete, a real node-policy delete, and full field alignment for workload policies (v1), workload rules (v2), targets, and node policies. Adds a three-layer test harness so this class of bug fails in CI instead of at a customer's terraform apply.

Why?

Customers were blocked creating Azure node policies — plan succeeded but apply failed inside the provider before any API call. Beyond that one bug, the provider had drifted ~2 months behind the backend: it still sent hpa_rule.target_utilization/primary_metric/target_memory_utilization (deleted server-side in July, causing "Provider produced inconsistent result after apply"), destroy left node policies and enabled targets running, out-of-band deletions bricked terraform plan, and a long list of new backend fields (JVM knobs, floor/ceiling bounds, RSS sizing, per-rule lookback, disabled, zonal shift, startup taints…) weren't reachable from Terraform.

How?

• Decode bug: getElementList/getElementMap decoded list/map elements via low-level tftypes.Value.As, which cannot populate tfsdk-tagged structs — every taints/raw block failed. They now use tfsdk.ValueAs (the framework's own reflection). The aws/azure schemas were also missing attributes their Go models declare (kubelet, capacity_reservation_selector_terms, context), which made Plan.Get fail on any config using those blocks; the attributes are now declared.
• Breaking: hpa_rule.target_utilization, target_memory_utilization and primary_metric are removed — the backend reserved those proto fields and dropped the columns, so they were already silent no-ops. hpa_rule.metrics is the replacement.
• disabled on workload rules is create-only in the upsert API; updates route through the ToggleWorkloadRuleDisabled RPC instead.
• Node policy target destroy disables the target (no delete RPC exists server-side) rather than silently leaving it enabled; cluster_ids validates to exactly one entry because the server rejects more (docs/example updated to a for_each per-cluster pattern).
• Read paths remove the resource from state on CodeNotFound instead of erroring; node-policy reads also skip the read-only source == "cluster" virtual policies that ListNodePolicies mixes in.
• fromProto pointer-receiver mutators were no-ops (m = &X{} on a local copy), which broke terraform import for nested blocks; rewritten as constructors.

Testing?

Three layers, all in go test, no network:

• schema_model_consistency_test.go — decodes a fully-populated (and an all-null) value built from each resource's real schema through Plan.Get → toProto → fromProto → State.Set. With the fix reverted it reproduces the customer's exact errors; it also caught two mistakes during this PR's own development.
• node_policy_decode_test.go — targeted regressions for the reported azure/taints failures, including the minimal vnet_subnet_id + one-taint config from the report.
• fake_server_test.go — an in-memory connect server mimicking dakr semantics (upsert keys, NotFound codes, target invariants, fields.disabled rejection on update, virtual cluster policies) driving real Create/Read/Update/Delete lifecycles, including refresh-after-out-of-band-delete and delete idempotency.

go build ./..., go vet ./..., full unit suite, and make generate (docs) are green.

Anything Else?

Deliberately deferred (large nested specs, follow-up PR): gcp/oci node classes, keda_scaled_object, jvm_heap_rule. Backend asks filed separately: a DeleteNodePolicyTarget RPC, a GetNodePolicy RPC, and protecting terraform_* workload-rule sources from v2-policy takeover.