fix: complete endpoint coverage and the defects the new tests found

[AlejandroFabianCampos]

Follow-up to #3, from a coverage and polish review of the endpoint resources. Three parts: acceptance coverage for what nothing exercised, the defects that coverage immediately found, and a prose pass.

Defects

All three were invisible to unit tests.

quicknode_endpoint_jwt has never worked. POST /v0/endpoints/{id}/security/jwts rejects a body with no kid:

{"error":"Invalid value for kid: Parameter kid is required"} (HTTP 400)

The provider modelled kid as a computed output and never sent one. kid is now a required input that forces replacement. That matches the API and matches what a caller needs: the same value goes in the kid header of the tokens signed with the matching private key.

quicknode_endpoint_domain_mask could not survive a refresh. The create route answers with domain_mask; GET /v0/endpoints/{id}/security answers with domain. The client read domain_mask in both places, so after a refresh the domain attribute was empty and every plan proposed a replacement:

# quicknode_endpoint_domain_mask.test must be replaced
-/+ resource "quicknode_endpoint_domain_mask" "test" {
      + domain = "tfacc.example.com" # forces replacement

Security entries disappear from state while their toggle is off. GET /v0/endpoints/{id}/security omits a list entirely when the matching toggle is disabled. An entry that was created successfully reads back as null until the toggle is enabled. The entry resources read that as a deletion and dropped the resource from state, so the next apply created a duplicate. This is reachable by following the provider's own advice, which recommends building an allowlist before turning enforcement on. Read now leaves state alone when a disabled toggle is the reason it cannot see the entry.

Endpoint label

label becomes Optional + Computed. PATCH /v0/endpoints/{id} requires a label, so Quicknode has no way to clear one; removing the attribute used to send an empty string on the next apply. It now leaves the endpoint's label in place and Terraform stops tracking it, which settles into an empty plan.

Acceptance coverage

Every resource now has a test. Before this branch the suite covered 5 of the 9 resources.

New case	Covers
TestAccEndpoint_labelSurvivesRemoval	dropping label leaves it alone
TestAccEndpoint_tagsStatusAndHeader	tag add and remove in one apply, pause and resume, setting and clearing ip_custom_header
TestAccEndpointToken_lifecycle	quicknode_endpoint_token, import by id
TestAccEndpointJWT_importByName	quicknode_endpoint_jwt, import by name
TestAccSecurityEntries_importByValue	quicknode_endpoint_domain_mask and _referrer, import by value
TestAccSecurityEntry_survivesDisabledToggle	an entry added before its toggle is enabled stays in state

All 13 cases pass against the live API. The JWT case uses a throwaway RSA public key generated for it; the matching private key was discarded.

Prose

"rather than" appeared 63 times across 29 files, 13 of them in documentation published to the Registry. It is gone. Alongside that:

• The safe_http_url description no longer repeats URL-assembly advice that the provider index already gives.
• The changelog's NOTES were four-sentence paragraphs; they are one-liners.
• Three copies of // Update exists only to satisfy the interface are one line each.

Still unmodelled

Scope decisions, unchanged: account-level tag rename and delete, endpoint-to-team assignment, GET /v0/endpoints/{id}/urls (the endpoint read already carries the URLs), and the metrics, logs, usage and billing read routes.