feat(runtime): add production control-plane foundation

apps/api/src/production-control-plane.ts

@@ -9,11 +9,14 @@ import { migrateDatabase } from './infrastructure/database/migrations.js';
 import { MacOSKeychainSecretStore } from './infrastructure/secrets/keychain-secret-store.js';
 import type { SecretStore } from './infrastructure/secrets/secret-store.js';
 import { createProductionUpstream } from './infrastructure/transport/production-upstream.js';
+import { createProductionReadiness, defaultKeychainMetadataCheck } from './production-readiness.js';
 
 export interface ProductionControlPlaneOptions {
   readonly databasePath: string;
   readonly store?: SecretStore;
   readonly upstream?: SafeControlPlaneUpstream;
+  readonly gatewayToken?: string;
+  readonly keychainMetadataCheck?: () => boolean | Promise<boolean>;
 }
 
 export function buildProductionControlPlane(
@@ -29,11 +32,20 @@ export function buildProductionControlPlane(
   const db = openDatabase(options.databasePath);
   try {
     migrateDatabase(db);
+    const store = options.store ?? new MacOSKeychainSecretStore();
     const app = buildControlPlaneApp({
       db,
-      store: options.store ?? new MacOSKeychainSecretStore(),
+      store,
       upstream: options.upstream ?? createProductionUpstream(),
-      app: { logger: {} },
+      app: {
+        logger: {},
+        ...(options.gatewayToken ? { gatewayToken: options.gatewayToken } : {}),
+        readiness: createProductionReadiness({
+          db,
+          gatewayToken: options.gatewayToken ?? '',
+          keychainMetadataCheck: options.keychainMetadataCheck ?? defaultKeychainMetadataCheck,
+        }),
+      },
     });
     app.addHook('onClose', async () => {
       if (db.open) db.close();