Stand up control-plane's real HTTP transport (POST/GET/DELETE /v1/tenants) matching the already-merged client

[JSONbored]

Problem

Split from #7180 — this piece is buildable now. packages/loopover-miner/lib/tenant-client.ts (merged via closed #7275) already calls POST /v1/tenants (body {name, product}), GET /v1/tenants, and DELETE /v1/tenants/:name, all Bearer-authenticated, against a configurable control-plane URL — but control-plane/ itself is a pure library today (control-plane/src/index.ts only re-exports functions; control-plane/package.json has no dev/deploy script; no wrangler.jsonc exists anywhere under control-plane/). There's no real HTTP service for the already-merged client to actually call.

Area

control-plane/ — needs to become a real deployable service, not just a library.

Proposal

Stand up the actual HTTP transport/routing layer implementing the exact contract tenant-client.ts already hardcodes: POST /v1/tenants, GET /v1/tenants, DELETE /v1/tenants/:name, Bearer-authenticated. This can be built and tested now against the existing fake driver — it doesn't need to wait on the real container/secret-injection pieces, since the HTTP layer just calls whichever driver (provisioning.ts's provisionTenant/deprovisionTenant) is currently wired in.

Deliverables

• A real Worker/service exposing the three routes above, matching tenant-client.ts's existing request/response shapes exactly (read that file first — it's the contract, not a suggestion).
• Bearer-token auth on all three routes.
• wrangler.jsonc (or equivalent) so this is actually deployable.
• Tests covering all three routes against the existing fake driver.

Resources

• Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (parent — this is one of its four independently-blocked pieces)
• packages/loopover-miner/lib/tenant-client.ts (the already-merged client — this issue's exact contract)
• control-plane/src/provisioning.ts, control-plane/src/index.ts

Boundaries

Transport/routing only — does not implement real container or database provisioning (separate pieces). Works against whichever driver (fake or real) is currently configured.

maintainer-only — admin-authenticated tenant create/destroy surface, not a first-pass contributor task.

[linear-code]

JSO-5405