feat(rest,config): wire CORS, real readiness, TLS options, error hygiene

- CORS config is now actually applied to the router (the middleware
  existed but was never wired); preflight returns 204 for allowed
  origins and 403 with no CORS headers for disallowed ones.
- /readyz runs real dependency checks (queue, auth database) and
  returns 503 with per-component detail when not ready; exported
  handlers support dedicated health listeners.
- Optional server.tls (cert_file/key_file) for REST and gRPC, validated
  at config load.
- 5xx responses no longer echo internal error details; not-found and
  already-sent map to 404/409 on cancel/retry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/rest/keys.go

@@ -120,7 +120,7 @@ func (h *KeyManagementHandler) CreateKey(w http.ResponseWriter, r *http.Request)
 	apiKey, err := h.keyStore.CreateKey(ctx, req.ClientID, req.Roles, req.RateLimit, expiresInDuration, authCtx.ClientID)
 	if err != nil {
 		h.logger.Errorf("Failed to create API key: %v", err)
-		h.respondError(w, http.StatusInternalServerError, "Failed to create API key", err.Error())
+		h.respondError(w, http.StatusInternalServerError, "Failed to create API key", "")
 		return
 	}
 
@@ -165,7 +165,7 @@ func (h *KeyManagementHandler) ListKeys(w http.ResponseWriter, r *http.Request)
 	keys, err := h.keyStore.ListKeys(ctx, clientID)
 	if err != nil {
 		h.logger.Errorf("Failed to list API keys: %v", err)
-		h.respondError(w, http.StatusInternalServerError, "Failed to list API keys", err.Error())
+		h.respondError(w, http.StatusInternalServerError, "Failed to list API keys", "")
 		return
 	}
 
@@ -218,7 +218,7 @@ func (h *KeyManagementHandler) RevokeKey(w http.ResponseWriter, r *http.Request)
 			h.respondError(w, http.StatusNotFound, "Key not found", "")
 		} else {
 			h.logger.Errorf("Failed to revoke API key: %v", err)
-			h.respondError(w, http.StatusInternalServerError, "Failed to revoke API key", err.Error())
+			h.respondError(w, http.StatusInternalServerError, "Failed to revoke API key", "")
 		}
 		return
 	}
@@ -291,7 +291,7 @@ func (h *KeyManagementHandler) GetAuditLog(w http.ResponseWriter, r *http.Reques
 	logs, err := h.keyStore.GetAuditLogByName(ctx, keyName, limit)
 	if err != nil {
 		h.logger.Errorf("Failed to get audit log: %v", err)
-		h.respondError(w, http.StatusInternalServerError, "Failed to get audit log", err.Error())
+		h.respondError(w, http.StatusInternalServerError, "Failed to get audit log", "")
 		return
 	}