Migrate deployment and promotion reads to FastAPI

[cbusillo]

Summary

• move GET /v1/deployments/{record_id} and GET /v1/promotions/{record_id} to native FastAPI routes with typed response models and OpenAPI coverage
• retire the matching direct WSGI read branches so fallback calls fail closed
• add native success/authn/authz/not-found/store-capability/fallback-precedence coverage and update service-boundary docs

Refs #1322

Validation

• uv run python -m unittest tests.test_http_app.FastApiDeploymentPromotionReadTests tests.test_service.LaunchplaneServiceTests.test_deployment_and_promotion_read_routes_are_retired_from_legacy_wsgi_app
• uv run python -m unittest tests.test_http_app tests.test_service
• uv run python -m unittest
• uv run --extra dev ruff check --diff control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev ruff format --check control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev mypy control_plane tests
• uv run --extra dev ruff check --diff .
• uv run --extra dev ruff check .
• JetBrains changed-files inspection: clean

Review

• Scout agents confirmed migrating both read routes together is safe and identified authz-order constraints
• Review agents: implementation reviewers green; Launchplane boundary reviewer green

Notes

• Repo-wide uv run --extra dev ruff format --check . still reports pre-existing formatting drift outside this slice; changed Python files are format-clean.