Migrate secret status reads to FastAPI

[cbusillo]

Summary

• migrate managed-secret status read routes to native FastAPI with strict metadata-only response models and OpenAPI contracts
• retire the legacy WSGI secret.read / secret.list matcher and handler branches for direct fallback calls
• document native ownership and authz ordering for list-by-path-context and single-read-by-stored-context behavior

Validation

• uv run python -m unittest tests.test_http_app.FastApiSecretStatusReadTests tests.test_service.LaunchplaneServiceTests.test_single_record_read_routes_are_retired_from_legacy_wsgi_app
• uv run python -m unittest tests.test_http_app tests.test_service
• uv run python -m unittest
• uv run --extra dev ruff check --diff .
• uv run --extra dev ruff check control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev ruff format --check control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev mypy control_plane tests
• uv run --extra dev ruff check .
• JetBrains changed-files inspection: clean, 0 problems

Note: uv run --extra dev ruff format --check . still reports the known unrelated repo-wide 56-file format baseline drift outside this diff; changed Python files are formatted.

Review

• 3 final read-only review agents: no blocking findings, ready to merge.