test(e2e): add expired backup cleanup coverage

[xgerman]

Summary

PR #346 migrates the legacy backup workflow into the unified Go/Ginkgo E2E suite, but it does not yet carry over the legacy expired-backup cleanup scenario from .github/workflows/test-backup-and-restore.yml.

This issue tracks restoring that coverage before retiring the legacy workflow.

Origin: #346 (comment)

Legacy behavior to preserve

The legacy workflow:

1. Creates or reuses a completed Backup CR.
2. Patches backup.status.expiredAt to a timestamp in the past, e.g. 2000-01-01T00:00:00Z, using the Kubernetes status subresource.
3. Polls until the operator deletes the expired Backup CR.

The important implementation detail is that this must patch status, not spec:

kubectl patch backup <name> \
  --type='merge' \
  --patch='{"status":{"expiredAt":"2000-01-01T00:00:00Z"}}' \
  --subresource=status

Proposed E2E shape

Add test/e2e/tests/backup/expiration_cleanup_test.go:

• Create a DocumentDB cluster using the existing backup area helpers.
• Create an on-demand Backup.
• Wait for Backup phase completed.
• Patch status.expiredAt to a past timestamp via c.Status().Patch(...).
• Eventually assert apierrors.IsNotFound for that Backup CR.

Add helpers in test/e2e/pkg/e2eutils/backup/backup.go:

• MarkExpired(ctx, c, backup, when) using c.Status().Patch(...).
• WaitForBackupDeleted(ctx, c, ns, name, timeout) mirroring the existing WaitForPVCDeleted helper style.

Definition of Done

• New Ginkgo spec exercises expired backup garbage collection.
• Status is patched through client.Status().Patch, not client.Patch.
• Helper unit tests cover WaitForBackupDeleted success and timeout paths.
• The spec is labeled consistently with backup tests, including backup and needs-csi-snapshots.
• Legacy workflow retirement is not considered complete until this coverage exists in the unified E2E suite.