feat(rest,config): wire CORS, real readiness, TLS options, error hygiene

- CORS config is now actually applied to the router (the middleware
  existed but was never wired); preflight returns 204 for allowed
  origins and 403 with no CORS headers for disallowed ones.
- /readyz runs real dependency checks (queue, auth database) and
  returns 503 with per-component detail when not ready; exported
  handlers support dedicated health listeners.
- Optional server.tls (cert_file/key_file) for REST and gRPC, validated
  at config load.
- 5xx responses no longer echo internal error details; not-found and
  already-sent map to 404/409 on cancel/retry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

config.yaml

@@ -5,6 +5,12 @@ server:
   rest_port: 8080
   host: "0.0.0.0"
   mode: "both" # Options: both, grpc, rest
+  # Optional TLS for both listeners. Leave disabled when a TLS-terminating
+  # gateway or service mesh fronts the service.
+  tls:
+    enabled: false
+    # cert_file: "/etc/notifier/tls/tls.crt"
+    # key_file: "/etc/notifier/tls/tls.key"
 
 queue:
   type: "local" # Options: local, kafka