feat(azure): Purview accounts (Microsoft.Purview)

[NitinKumar004]

Summary

Adds the Microsoft.Purview/accounts ARM control-plane service (Track-1 emulation, no data plane), following the established Azure-only pattern (communication / managedgrafana / devcenter templates).

• Provider mock providers/azure/purview — CreateOrUpdate / Get / Delete / List (by RG + subscription) / ListKeys / PurgeResourceGroup, with snapshot/restore.
• Wire handler server/azure/purview — ARM PUT/PATCH/GET/DELETE/list + POST /listkeys. Sync 201/200, 200-then-204 idempotent delete, 404s.
• Resource-graph discovery wired additively: ServicePurview / TypePurviewAccount walker constants, and both forward (microsoft.purview/accounts → {purview, Account}) and inverse (purview/Account → microsoft.purview/accounts) type-map entries.
• RG-purge cascade + from_provider + factory wiring; docs/coverage regenerated (purview-only diff).

Computed-field stability (drift-critical)

All minted once at create, stored, and byte-stable across every GET/PATCH:

• endpoints.catalog/guardian/scan = https://<name>.purview.azure.com/{catalog,guardian,scan}
• managedResources.resourceGroup/storageAccount/eventHubNamespace — deterministic ARM ids under the managed RG
• managedResourceGroupName defaults to managed-rg-<name> when omitted
• identity.principalId/tenantId via stable SyntheticGUID seeds
• sku {Standard, capacity 1}, provisioningState = Succeeded
• ListKeys → deterministic atlasKafkaPrimaryEndpoint/secondaryEndpoint connection strings

Identity and sku are modeled explicitly (top-level, not echoed). PATCH merges only supplied fields; resource-level tag update replaces; location immutable.

E2E evidence (raw ARM, serve on :18053)

• PUT → 201 with full computed body; GET ×2 → byte-identical
• PATCH tags → 200, tags replaced, all computed fields + identity + managedEventHubState preserved (verified stable)
• POST /listkeys → 200, stable primary≠secondary Atlas Kafka connection strings
• DELETE → 200, DELETE again → 204, GET → 404
• Resource Graph where type =~ "microsoft.purview/accounts" → 1 row (forward+inverse map)
• Resource-group delete → account purged (cascade)

Terraform azurerm_purview_account apply was blocked by the documented macOS azurerm TLS-trust issue at the metadata bootstrap (before reaching Purview); the raw ARM lifecycle above proves every field azurerm reads on plan.

Gates (GOMAXPROCS=3)

go build ./..., go vet, gofmt -l, golangci-lint (new pkgs = 0), go test -race new pkgs, full server/azure/... providers/azure/... resourcediscovery resourcegraph persist suites, root go test ., and go generate idempotency — all green.