chore: update vcluster annotations reference with undocumented entries (#2124)

Co-authored-by: Piotr1215 <8086638+Piotr1215@users.noreply.github.com>

Author: loft-bot

vcluster/reference/annotations.mdx

@@ -45,6 +45,16 @@ Identifies the namespace where the vCluster is deployed in the host cluster.
 
 Indicates that this resource is managed by vCluster and should not be modified directly.
 
+### vcluster.loft.sh/protected {#vcluster-loft-sh-protected}
+
+**Type:** Label
+
+**Example:** `vcluster.loft.sh/protected: "apiservice"`
+
+**Used on:** Service and Endpoint resources backing APIServices
+
+Identifies APIService backend resources that should be protected from deletion by ValidatingAdmissionPolicy. The label value names the feature owning the resource for scoped policy bindings.
+
 ## Sync control annotations {#sync-control-annotations}
 
 These annotations control how vCluster syncs resources between the virtual and host clusters.