E2E: expand default_application_auth_strategy scenario to cover update and removal lifecycle

[Copilot]

The existing scenario only covered CREATE + idempotency for default_application_auth_strategy_id, leaving UPDATE, REMOVE, and sync-DELETE paths completely untested — including the !ref cross-resource reference resolution in the portal planner.

New e2e scenario steps

• 002 — get portal after initial apply; asserts default_application_auth_strategy_id is a 36-char UUID
• 003 — UPDATE: switch to a second auth strategy via !ref apikey-app-auth-strategy-2#id; plan/apply/get-portal + idempotency
• 004 — REMOVE: omit default_application_auth_strategy_id from portal YAML; plan shows UPDATE, apply clears the field, get-portal asserts null + idempotency
• 005 — SYNC-DELETE: overlay both strategy files with empty lists; asserts DELETE for both, then verifies 0 changes on re-plan

New fixtures: testdata/app-auth-strategy-2.yaml and overlay dirs 003–005.

Implementation: clear default_application_auth_strategy_id (previously unsupported)

Step 004 required a new capability — the SDK's UpdatePortal struct uses omitempty, so it cannot express explicit JSON null. Two changes make this work:

Planner (portal_planner.go): when desired.DefaultApplicationAuthStrategyID == nil but current portal has it set, plan an UPDATE with the sentinel value ClearDefaultAuthStrategyID = "$clear-default-auth-strategy".

Executor (portal_operations.go): when the sentinel is detected, skip setting the SDK field and after the UpdatePortal call, invoke ClearPortalDefaultAuthStrategyID.

New PortalAPI method (helpers/portals.go): bypasses the SDK and sends a raw PATCH:

type patchPayload struct {
    DefaultApplicationAuthStrategyID *string `json:"default_application_auth_strategy_id"`
}
body, _ := json.Marshal(patchPayload{DefaultApplicationAuthStrategyID: nil})
// → {"default_application_auth_strategy_id": null}

PortalAPIImpl now stores BaseURL and BearerToken (populated via KonnectSDK from the existing factory) to construct the authenticated raw request.

All four PortalAPI mock implementations updated accordingly.