HTTPRoute/GRPCRoute status is written before Provider.Update, so translation and sync failures are invisible

Problem

HTTPRouteReconciler.Reconcile writes the route status before it programs the data plane:

1. SetRouteConditionAccepted / SetRouteConditionResolvedRefs populate hr.Status.Parents
2. r.Updater.Update(...) and UpdateStatus(...) persist that status
3. then r.Provider.Update(ctx, tctx, routeToUpdate) runs, which is where translation happens
4. an error from Provider.Update is only returned for requeue

So any failure that originates in translation (or anywhere else inside Provider.Update) never reaches the status. The route reports Accepted=True / ResolvedRefs=True while nothing has been programmed, and the user has no signal that their configuration is not in effect. Retries keep failing silently.

GRPCRouteReconciler.Reconcile has the same ordering.

There is no admission gate to compensate on these paths: httproute_webhook.go only implements collectWarnings (no adcValidator, unlike apisixroute_webhook.go / apisixconsumer_webhook.go), and v1alpha1 PluginConfig has no webhook at all.

For contrast, apisixglobalrule_controller.go and ingress_controller.go both call Provider.Update first and reflect its error in the status condition, which is the behavior we want here.

Expected behavior

Either move the status write after Provider.Update, or fold the Provider.Update error into the conditions before persisting, so a translation or sync failure is visible on the object.

Affected

• internal/controller/httproute_controller.go
• internal/controller/grpcroute_controller.go

Context

Surfaced during review on #441. It is pre-existing and independent of that PR, but it is what makes any fail-closed behavior on the Gateway API route paths invisible, so it blocks #452 from being user-observable.

Upstream: apache/apisix-ingress-controller#2840

Start in internal/controller/httproute_controller.go and internal/controller/grpcroute_controller.go, tracing the status writes and Provider.Update calls in Reconcile. Compare their ordering and error handling with apisixglobalrule_controller.go and ingress_controller.go. Done means translation or sync failures from Provider.Update are reflected in the route status instead of only triggering a requeue.