feat: add Lambda hosted-app control plane

[danny-avila]

Summary

Adds the stateful-profile control-plane half of resident hosted apps on top of #57.

• snapshots one exact owner-bound stateful workspace revision and restores it into a dedicated app-host MicroVM
• persists fenced/idempotent lifecycle intent and encrypted short-lived preview credentials
• isolates lifecycle work on a stateful-only BullMQ queue while keeping disabled/default deployments free of extra hosted-app queue clients
• exposes authenticated start/status/stop APIs and a wildcard, per-app unprivileged preview gateway
• strips privileged headers/cookies, pins proxy traffic to the AWS endpoint origin, constrains browser subresource/fetch capabilities with a gateway-owned CSP, and supports streamed HTTP/SSE
• validates split API/worker config and documents wildcard DNS/TLS and deployment requirements

Safety and lifecycle properties

• immutable (app_id, revision, spec) contract
• exact provider-request fingerprint plus persisted client token for ambiguous-launch replay
• same-token replay resumes a suspended accepted VM instead of rotating the token and orphaning it
• stop reconciles a no-ID ambiguous launch before termination and never erases a possibly-live provider intent
• destructive replacement is durably recorded as TERMINATING before the AWS call, so later Redis/generation failures cannot leave a dead VM advertised as running
• provider startedAt anchors the lease deadline; ambiguous expiry also budgets provider-call latency
• per-app and source-workspace locking with fencing/heartbeat semantics
• stopped source VMs reuse their last committed checkpoint; live sources checkpoint and read the pointer under one lock
• failed termination never drops the known VM id or promotes a partial launch to running
• app-origin capabilities are owner- and revision-bound, short-lived, host-only, and use a key distinct from stored-credential encryption
• expired leases/credentials fail closed; stored provider details are redacted from public status
• refreshed preview records are re-authorized after the worker round trip
• preview responses are non-storable, redirects resolve against the current route and stay same-origin, and original query bytes are preserved
• arbitrary app routes are collapsed before Prometheus labeling; lazy hosted-app queue resources have explicit error handlers
• app requests cannot override root-launch-sensitive environment variables
• the control-plane ports/readiness timeout are fixed to the pinned image contract instead of exposing ineffective overrides
• safe runner 4xx errors retain their classification across BullMQ; provider details remain redacted
• browser fetches/subresources remain same-origin and workers/service workers are disabled across revisions

Browser boundary

A top-level app document can still navigate the owner's browser to another origin. This experimental viewer is therefore owner-trusted. Before broad untrusted enablement, app content must be placed on a separate origin inside a sandboxed gateway wrapper. The runbook states this restriction explicitly.

Verification

• bun test service/src/hosted-app/*.test.ts service/src/middleware/httpMetrics.test.ts service/src/secure-startup.test.ts — 82 pass
• bun run test in service — 604 pass
• bun run build in service — pass (only two pre-existing TS2352 warnings)
• git diff --check — pass
• exact-head CI — 5/5 green at 00c6ce7

Dependency

Stacked on #57 at 7aaab6c. Review this PR as the service/control-plane continuation; retarget it to main after #57 lands.