feat(rest,config): wire CORS, real readiness, TLS options, error hygiene

- CORS config is now actually applied to the router (the middleware
  existed but was never wired); preflight returns 204 for allowed
  origins and 403 with no CORS headers for disallowed ones.
- /readyz runs real dependency checks (queue, auth database) and
  returns 503 with per-component detail when not ready; exported
  handlers support dedicated health listeners.
- Optional server.tls (cert_file/key_file) for REST and gRPC, validated
  at config load.
- 5xx responses no longer echo internal error details; not-found and
  already-sent map to 404/409 on cancel/retry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/rest/cors_test.go

@@ -171,13 +171,13 @@ func TestCORSMiddleware_PreflightRequest(t *testing.T) {
 		{
 			name:          "preflight from allowed origin",
 			origin:        "https://example.com",
-			expectStatus:  http.StatusOK,
+			expectStatus:  http.StatusNoContent,
 			expectHeaders: true,
 		},
 		{
 			name:          "preflight from blocked origin",
 			origin:        "https://malicious.com",
-			expectStatus:  http.StatusOK,
+			expectStatus:  http.StatusForbidden,
 			expectHeaders: false,
 		},
 	}
@@ -191,7 +191,8 @@ func TestCORSMiddleware_PreflightRequest(t *testing.T) {
 			rec := httptest.NewRecorder()
 			handler.ServeHTTP(rec, req)
 
-			// Preflight should always return 200 OK
+			// Allowed preflights succeed with 204; blocked ones get 403
+			// with no CORS headers so the browser rejects the request.
 			if rec.Code != tt.expectStatus {
 				t.Errorf("status = %v, want %v", rec.Code, tt.expectStatus)
 			}