HTTPRoute/GRPCRoute status is written before Provider.Update, so translation and sync failures are invisible

### Problem

`HTTPRouteReconciler.Reconcile` writes the route status before it programs the data plane:

1. `SetRouteConditionAccepted` / `SetRouteConditionResolvedRefs` populate `hr.Status.Parents`
2. `r.Updater.Update(...)` and `UpdateStatus(...)` persist that status
3. **then** `r.Provider.Update(ctx, tctx, routeToUpdate)` runs, which is where translation happens
4. an error from `Provider.Update` is only returned for requeue

So any failure that originates in translation (or anywhere else inside `Provider.Update`) never reaches the status. The route reports `Accepted=True` / `ResolvedRefs=True` while nothing has been programmed, and the user has no signal that their configuration is not in effect. Retries keep failing silently.

`GRPCRouteReconciler.Reconcile` has the same ordering.

There is no admission gate to compensate on these paths: `internal/webhook/v1/httproute_webhook.go` only implements `collectWarnings` (no `adcValidator`, unlike `apisixroute_webhook.go` / `apisixconsumer_webhook.go`), and v1alpha1 `PluginConfig` has no webhook at all.

For contrast, `apisixglobalrule_controller.go` and `ingress_controller.go` both call `Provider.Update` first and reflect its error in the status condition, which is the behavior we want here.

### Expected behavior

Either move the status write after `Provider.Update`, or fold the `Provider.Update` error into the conditions before persisting, so a translation or sync failure is visible on the object.

### Affected

- `internal/controller/httproute_controller.go`
- `internal/controller/grpcroute_controller.go`

### Context

Surfaced during review on #2814. It is pre-existing and independent of that PR, but it is what makes any fail-closed behavior on the Gateway API route paths invisible.

Read internal/controller/httproute_controller.go and internal/controller/grpcroute_controller.go, focusing on the order of status persistence and Provider.Update. Compare the ordering and error-condition handling in apisixglobalrule_controller.go and ingress_controller.go. Done means translation or sync failures from Provider.Update are reflected in the HTTPRoute and GRPCRoute status instead of remaining invisible.

Written by the indexing model from the issue text.