Move public ingress monitor run-once to FastAPI

[cbusillo]

Summary

• Move POST /v1/products/public-ingress-monitor/run-once to the native FastAPI app.
• Remove the stale legacy WSGI read-route matcher and public-ingress monitor fallback branch.
• Preserve authz, optional notification wiring, idempotency replay/conflict behavior, and fail-closed store checks.
• Update service-boundary and compatibility-retirement docs for the native route ownership.

Refs #1322

Validation

• uv run python -m unittest tests.test_http_app.FastApiPublicIngressMonitorTests tests.test_service.LaunchplaneServiceTests.test_public_ingress_monitor_run_once_legacy_wsgi_fallback_is_removed
• git diff --check
• uv run --extra dev ruff check --fix --diff control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev ruff format --check control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev mypy control_plane/http_app.py control_plane/service.py tests/test_http_app.py tests/test_service.py
• uv run --extra dev ruff check .
• uv run --extra dev mypy control_plane tests
• uv run python -m unittest
• JetBrains/PyCharm closeout, changed files: clean, 0 problems

Review

• Read-only scout confirmed the legacy _match_read_route entry was stale classification, not a real GET read API.
• Three review agents reported no blocking findings.
• Non-blocking review notes about store-capability test coverage and test colocation were addressed before commit.