feat: integrate Opskit readiness and admin routes

[jaredjakacky]

Summary

Adds optional Opskit integration to Servekit’s operational HTTP surface.

• adds WithOps(...) to include Opskit registry readiness in /readyz
• adds opt-in read-only Opskit admin routes:
  • GET /admin/components
  • GET /admin/components/{name}
• adds WithOpsAdminAuthGate(...) for application-owned admin route protection
• adds WithOpsTimeout(...) for Opskit readiness and component snapshot reads
• documents readiness ordering, admin route behavior, and production auth expectations

Readiness Semantics

When WithOps(...) is configured, /readyz evaluates readiness in this order:

1. Servekit lifecycle readiness
2. Opskit registry readiness
3. legacy WithReadinessChecks(...)

Servekit remains the HTTP/probe presentation layer. Opskit owns component readiness aggregation.

Admin Route Semantics

Opskit admin routes are:

• opt-in through WithOpsAdmin()
• read-only
• access-logged by default
• skipped from telemetry
• unauthenticated by default, with protection available through WithOpsAdminAuthGate(...) or network-level controls

WithDefaultEndpointsEnabled(false) disables built-in probe/version routes but does not disable explicitly enabled Opskit admin routes.

Tests

Adds coverage for:

• Opskit readiness behavior and timeout handling
• /readyz evaluation order
• admin route opt-in behavior
• admin auth gate behavior
• admin access logging
• default endpoint disabling interaction
• passive component inventory behavior