Apply the Access webhook invariant to sibling reconciler test fixtures

Follow-up from #47.

#47 updated auth_test.go's defaultAuthModel() to include Access.Groups: ["data-scientists"] with a comment explaining the webhook invariant. Other reconciler unit tests still construct Access: AccessSpec{}:

• operator/internal/controller/reconcilers/modelservice_test.go
• operator/internal/controller/reconcilers/storage_test.go
• operator/internal/controller/reconcilers/networkpolicy_test.go
• operator/internal/controller/reconcilers/inferencepool_test.go
• operator/internal/controller/reconcilers/routing_test.go

These are pure-function tests that bypass the webhook, so they still compile and pass. The risk is that someone later copies one of these newTestModel/defaultModel helpers into an auth-sensitive test and hits the invariant only at admission time.

Options

1. Apply the same Access.Groups default (with the same why-comment) to every sibling defaultXxxModel() helper.
2. Pull a shared reconcilers/testutil.DefaultValidModel() builder and have all _test.go files call it.

(2) is a bigger refactor but leaves only one invariant-documenting comment for future authors to trip over.

Start by comparing auth_test.go's defaultAuthModel() with the helpers in modelservice_test.go, storage_test.go, networkpolicy_test.go, inferencepool_test.go, and routing_test.go. Review the two proposed approaches with a maintainer, then update the fixtures consistently and run the affected reconciler unit tests to confirm they still pass.