feat(controlplane-api): implement controlplane-api with GraphQL

[BjoernKarma]

Summary

• Add new controlplane-api component: a read-only GraphQL API over PostgreSQL using ent + gqlgen + entgql, served via Fiber (common-server)
• Implements team-scoped data isolation via ent privacy policies and a team filter interceptor, with JWT/OAuth2 auth delegated to common-server
• Includes full code generation pipeline (ent schemas → ent.graphql → gqlgen resolvers) with SPDX header injection via hack/boilerplate.go.txt
• Integrates into CI workflow, dependabot, and goreleaser

What's included

• Ent schemas for 9 entities: Team, Application, ApiExposure, ApiSubscription, Approval, ApprovalRequest, Zone, Group, Environment
• Privacy layer: viewer-based query policies, mutations always denied (read-only)
• Team filter interceptor: restricts query results based on viewer's teams (team/group/admin client types)
• Custom resolvers: ownerTeam (cross-tenant safe via TeamInfo), roverStatus (computed), type resolvers for JSON-embedded enums
• README.md with architecture overview and development instructions

Test plan

• Tests will follow in a separate PR (unit tests + integration tests with testcontainers-go)
• make build (generate + compile) passes
• golangci-lint run passes (0 issues)
• pre-commit hooks pass (reuse-lint-file, gitleaks)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.