Refresh validateAuthzConfig doc comment

The prior comment said backend validation lived in the controller "because
the API types package must not import the authorizer backends" — but the
types package now imports pkg/authz/authorizers to call IsRegistered in
Validate(). Restate the real reason: type-level Validate handles structural
+ registration checks; backend ValidateConfig requires the full
reconstructed JSON envelope that only the controller builds.

Drive-by: gitignore .pr-review/ so PR-review skill scratch dirs don't
pollute git status in worktrees.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: ChrisJBurns

.gitignore

@@ -50,3 +50,4 @@ cmd/vmcp/__debug_bin*
 
 # Superpowers planning artifacts
 docs/superpowers/
+.pr-review/

cmd/thv-operator/controllers/mcpauthzconfig_controller.go

@@ -173,9 +173,11 @@ func setValidTrueCondition(c *mcpv1beta1.MCPAuthzConfig) {
 // validation on the type (Validate()), then reconstructs the full authorizer config
 // and delegates backend-specific validation to the factory's ValidateConfig method.
 //
-// Backend validation lives here rather than as a Validate() method on the type because
-// it requires the authorizer factory registry — an external dependency that the API
-// types package must not import.
+// The type's Validate() handles structural checks and verifies that spec.type is
+// a registered backend. Backend-specific schema validation lives here because
+// the factory's ValidateConfig consumes the full reconstructed JSON envelope
+// (version + type + nested config), which it is not the type's responsibility
+// to build.
 func (*MCPAuthzConfigReconciler) validateAuthzConfig(authzConfig *mcpv1beta1.MCPAuthzConfig) error {
 	if err := authzConfig.Validate(); err != nil {
 		return err