Register pprof debug endpoints behind admin-token auth

[AbirAbbas]

Summary

• Registers /debug/pprof/* endpoints (index, cmdline, profile, symbol, trace, and named profiles) on the control-plane gin router.
• All pprof endpoints are gated by the X-Admin-Token header with constant-time comparison, returning 401 on missing or wrong tokens.
• When no admin token is configured, pprof endpoints remain open (consistent with existing admin route behavior).
• Seven tests cover valid-token, no-token, wrong-token, and named-profile scenarios.

Closes #428

Changes

• control-plane/internal/server/server.go — Registers the new admin pprof route group.
• control-plane/internal/server/routes_admin.go — Adds pprof middleware (constant-time token check returning 401) and route registration.
• control-plane/internal/server/routes_admin_test.go — Seven test cases covering token auth and profile endpoint selection.

Test plan

• go vet ./... passes clean.
• go test ./internal/server/... passes (the pre-existing TestStartAndStopCoverAdditionalBranches failure is unrelated and also present on clean main).
• Manually verified: hitting /debug/pprof/ without a token returns 401; with the correct token returns the pprof index.

🤖 Built with AgentField SWE-AF

🔌 Powered by AgentField

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	86.90%	87.40%	↓ -0.50 pp	🟡
sdk-go	92.40%	92.00%	↑ +0.40 pp	🟢
sdk-python	93.82%	93.73%	↑ +0.09 pp	🟢
sdk-typescript	91.05%	90.42%	↑ +0.63 pp	🟢
web-ui	84.76%	84.79%	↓ -0.03 pp	🟡
aggregate	85.55%	85.75%	↓ -0.20 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	30	100.00%	✅
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.