Prevent Account deletion from targeting a different NatsCluster

[choufraise]

Problem

Account reconciliation rejects changes to spec.natsClusterRef when the Account is already bound to another NatsCluster.

The deletion path bypasses that binding check. It resolves the current cluster reference and can execute AccountManager.Delete against a different cluster than the one stored in account.nauth.io/nats-cluster-id.

This can leave the original NATS account orphaned or delete an account with the same ID from the wrong cluster.

Proposed change

Validate the Account’s persisted NATS cluster binding before any deletion-side NATS operation.

If the resolved NatsCluster UID differs from account.nauth.io/nats-cluster-id:

• Do not call FindAccountID, JetStream lookup, or DeleteAccount.
• Keep the Account finalizer.
• Report a clear reconciliation error.

Acceptance criteria

• Deletion of an Account with a matching cluster UID behaves unchanged.
• Deletion with a changed or mismatched NatsClusterRef is blocked.
• A controller regression test verifies that AccountManager.Delete is not called on mismatch.
• The existing normal-reconciliation rebinding behavior remains unchanged.