feat(natscluster): block deletion while accounts are bound

[henriropp]

Summary

Prevent NatsCluster deletion from completing while Account resources are still bound to that cluster. This protects cluster/account relationships from being orphaned and surfaces the blocked deletion state through controller status until the bindings are removed.

What changed

• add a NatsCluster finalizer and deletion logic that checks for bound accounts by cluster UID before allowing removal
• watch Account delete events from the NatsCluster controller so deletion is retried after bindings are removed
• persist the bound cluster UID on Account resources via account.nauth.io/nats-cluster-id
• reject rebinding an account to a different cluster UID once it has already been bound
• update manager RBAC to allow natsclusters updates/finalizer updates and add Helm test coverage for those permissions
• extend KUTTL coverage to verify account-to-cluster binding and add an e2e scenario that confirms NatsCluster deletion is blocked until the bound account is deleted
• refactor account and nats cluster controller tests to setup state in given, without using the reconcile function that it is testing
• refactor cluster target lookup to happen in controller, and pass down to manager.

How to validate

make lint
make test
make test-e2e

[choufraise]

👍 LGTM