Creates a single long-running parent job that orchestrates subscription-level import jobs.
The parent job discovers subscriptions, dispatches child import jobs (one per subscription),
aggregates progress, and determines overall success/failure.

Two modes are supported:

1. Import All: Set importAll: true to discover all subscriptions and import all resources
2. Selective Import: Provide specific subscriptions and optional resource IDs to import.
   Empty or omitted resources is valid for both Reconcile and Additive.
   Under Reconcile, that empty list is the desired snapshot and existing managed resources on those
   subscriptions are soft-deleted. Under Additive, the subscription is registered or kept and existing
   managed resources are preserved.

Selective imports default to Reconcile: subscriptions omitted from the request are soft-deleted.
Set importMode to Additive to preserve subscriptions and resources omitted from the request.

When importing, CloudSubscription records are automatically created for Azure subscriptions
that don't exist yet in the system. These subscriptions are linked to the tenant and use
the tenant's default credentials.