Add override support for subscriptions, gateways, and products

[petehauge]

Summary

The override system currently supports 5 resource sections: namedValues, backends, apis, diagnostics, and loggers. Several other top-level resource types that commonly differ between environments are missing override support.

Missing override sections (prioritized)

High priority

• Subscriptions — different scope/keys per environment
• Gateways — different gateway configurations per environment (e.g., self-hosted gateway endpoints)
• Products — different approval settings, quotas, or subscription limits per environment

Lower priority (may not need overrides in practice)

• PolicyFragments — could need env-specific policy content
• PolicyRestrictions — could need env-specific config
• ServicePolicy — could need env-specific policy content

What needs to change

For each new section:

1. Add an XxxOverride interface in src/models/config.ts
2. Add the section field to OverrideConfig
3. Add a case ResourceType.Xxx in src/services/override-merger.ts
4. Add the section name to normalizeOverrideSection() in src/lib/config-loader.ts
5. Update docs/guides/environment-overrides.md with examples
6. Add unit tests

Context

Raised from PR #102 review feedback (comment by @EMaher).