Reject creating building block instance with undeclared input during plan phase

[JohannesRudolph]

Description

When creating a meshstack_building_block_v2 instance and passing an input key that is not declared on the referenced Building Block Definition version, the API returns a 400 Bad Request. The provider surfaces this as a raw HTTP error with the full JSON response body, which is hard to action.

Error

Error: Error creating building block
Could not create building block, unexpected error: http error 400,
response '{"message":"The following inputs are not known for the Building
Block Definition Version <uuid>: single_select(SINGLE_SELECT)",
"errorCode":"BadRequest",...}'

Desired Behavior

The provider should validate inputs against the Building Block Definition before making the API call and surface a clear, actionable Terraform diagnostic — e.g.:

Error: Unknown input key
  Input "single_select" is not declared on Building Block Definition Version <uuid>.
  Declared inputs are: text

Maybe this can already be done during the plan phase? I don't think the current 400 error is too bad, but its frustating have tofu plan run fine and then have tofu apply fail.

Minimal Reproduction

run "reproduces_unknown_input_400_error" {
  expect_failures = [meshstack_building_block_v2.repro]
}

# BBD that only declares a "text" input — no single_select
resource "meshstack_building_block_definition" "repro" {
  metadata = {
    owned_by_workspace = "my-workspace"
    tags               = {}
  }

  spec = {
    display_name = "repro-unknown-input"
    description  = "BBD for reproducing unknown input 400 error."
    target_type  = "WORKSPACE_LEVEL"
    readme       = "Reproduction case."
  }

  version_spec = {
    draft         = true
    deletion_mode = "PURGE"
    implementation = {
      manual = {}
    }
    inputs = {
      text = {
        assignment_type = "USER_INPUT"
        display_name    = "Text"
        type            = "STRING"
      }
    }
    outputs = {
      text = {
        assignment_type = "NONE"
        display_name    = "Text"
        type            = "STRING"
      }
    }
  }
}

# Passing single_select which is NOT declared on the BBD above
resource "meshstack_building_block_v2" "repro" {
  spec = {
    building_block_definition_version_ref = meshstack_building_block_definition.repro.version_latest

    display_name = "repro-unknown-input"
    target_ref = {
      kind       = "meshWorkspace"
      identifier = "my-workspace"
    }

    inputs = {
      text          = { value_string = "hello" }
      single_select = { value_single_select = "option1" } # not declared on the BBD
    }
  }
}

[grubmeshi]

Note that validating this within the provider might prove difficult as the API does not always allow to fetch the full BBD object from a different workspace if the API key does not have sufficient permissions. So I'd vote for moving that into the backend, which would also avoid duplicating to much validation logic in the provider (which also needs to to kept in sync).