Account for embedded auth env in deployment drift checks

[JAORMX]

Summary

• include embedded auth env vars when comparing expected proxy deployment env for MCPServer
• do the same for MCPRemoteProxy so self-generated deployments are not treated as drifted
• add regression tests for embedded auth and token exchange cases, plus associative-list reordering checks in the Kubernetes client tests

This is the concrete operator-side fix identified while debugging #4877.

Testing

• go test ./cmd/thv-operator/controllers ./pkg/container/kubernetes

Closes #4877.

[codecov]

Codecov Report

❌ Patch coverage is 78.94737% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.25%. Comparing base (12f25e5) to head (c0660ca).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
...-operator/controllers/mcpremoteproxy_controller.go	80.00%	1 Missing and 1 partial ⚠️
...d/thv-operator/controllers/mcpserver_controller.go	77.77%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4878      +/-   ##
==========================================
+ Coverage   69.12%   69.25%   +0.12%     
==========================================
  Files         531      531              
  Lines       55183    55178       -5     
==========================================
+ Hits        38146    38212      +66     
+ Misses      14113    14028      -85     
- Partials     2924     2938      +14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jhrozek]

Looks good — the core fix is correct, env var ordering between creation and drift check paths is consistent, and test coverage directly validates the bug fix.

One nit: the two SSA reordering tests in pkg/container/kubernetes/client_test.go (TestStatefulSetApplyAssociativeListReorderingDoesNotChangeGeneration, TestServiceApplyAssociativeListReorderingDoesNotChangeGeneration) test the behavior of fake.NewClientset(), not any production code in this package. The fake client doesn't implement real SSA merge semantics, so these document an assumption about SSA associative-list handling rather than validating it. If real validation is wanted, these would need to run against envtest. They're also unrelated to the drift check fix itself — might be cleaner as a separate commit.