Add unit tests for status and condition helper functions

## Summary

Write unit tests for the pure functions that check, compare, and build Kubernetes status conditions. These are critical to the controller's decision-making and are all testable without envtest.

## Testing Guidance

For each function, think about:
- What does it return for normal, expected input?
- What happens at the boundaries — nil conditions, empty slices, missing fields?
- If there's branching logic, have you covered each branch?

## Scope

### `api/v1alpha1/apikey_types.go`
- `IsApproved()` — checks whether an APIKey has an "Approved" condition set to True. Consider: condition present and True, condition present and False, no conditions at all, nil status.

### `internal/controller/apiproduct_helper.go`
- `IsAuthPolicyAcceptedAndEnforced()` — returns true only when both Accepted and Enforced conditions are True. Think about each combination: both true, one true, neither, nil policy.
- `IsAuthPolicyAccepted()`, `IsAuthPolicyEnforced()` — individual condition checks.
- `IsAuthPolicyConditionTrue()` — generic condition checker. Handles nil policy — test that path.

### `internal/controller/apiproduct_controller.go`
- `authPolicyDiscoveredCondition()` — builds a condition reflecting whether an AuthPolicy was found and is accepted+enforced. Test with nil policy, found but not enforced, and fully healthy.
- `openAPISpecReadyCondition()` — builds a condition for OpenAPI spec readiness. Has three paths: no URL configured (returns nil), fetch error, and success.
- `oidcDiscoveredCondition()` — builds a condition for OIDC discovery. Has three paths: no auth scheme, fetch error, and success.

### `internal/controller/apikey_status_controller.go`
- `getInvalidReason()` — returns a reason string from a condition, or a default if nil. Simple null-safe getter.

### `internal/controller/apikeyrequest_status_controller.go`
- `conditionsEqual()` — compares two condition slices ignoring `LastTransitionTime`. Think about: same conditions, different order, different status, empty slices, nil.
- `copyConditions()` — deep copies a condition slice. Verify the copy is independent of the original (mutating the copy shouldn't affect the source).

## Review & Verification

PRs should include:
- How to review the changes (areas of interest, suggested review order)
- Steps to confirm locally: `make test` runs and passes

Start by reading the listed helpers and controller functions in api/v1alpha1/apikey_types.go and internal/controller/*.go, then inspect nearby test conventions. Add unit tests for the specified normal, nil, boundary, branch, comparison, and deep-copy cases without envtest. Run make test and confirm all tests pass.

Written by the indexing model from the issue text.