feat(api): add contract-safe jobs read endpoints

apps/api/src/control-plane.ts

@@ -24,6 +24,8 @@ import { DeleteInstanceOperation } from './application/operations/delete-instanc
 import type { SecretStore } from './infrastructure/secrets/secret-store.js';
 import { registerInstanceRoutes } from './interface/http/instance-routes.js';
 import { registerEventRoutes } from './interface/http/event-routes.js';
+import { JobQueryService } from './application/jobs/job-query-service.js';
+import { registerJobRoutes } from './interface/http/job-routes.js';
 
 export interface SafeControlPlaneUpstream extends ConnectionTransport {
   request: UpstreamSessionClientOptions['request'];
@@ -42,6 +44,7 @@ export interface ControlPlaneApp extends FastifyInstance {
 }
 export function buildControlPlaneApp(options: ControlPlaneOptions): ControlPlaneApp {
   const eventJournal = new EventJournal(options.db);
+  const jobs = new JobQueryService(options.db);
   const instances = options.now
     ? new InstanceService({ db: options.db, store: options.store, now: options.now })
     : new InstanceService({ db: options.db, store: options.store });
@@ -86,6 +89,7 @@ export function buildControlPlaneApp(options: ControlPlaneOptions): ControlPlane
         registerDeletionPreparationRoute: false,
       });
       registerOperationRoutes(app, operationCatalogRegistry, secureExecution, deletion);
+      registerJobRoutes(app, { jobs });
       registerEventRoutes(app, {
         journal: eventJournal,
         ...(options.authenticateEventStream