Add secure Bird gateway for Pleno Control Plane (#332)

Add the Bird Control Plane gateway, signed webhook ingestion, policy-gated writes, fail-closed production auto-activation, and RSA-OAEP bootstrap credential flow.

Dockerfile.coolify-api

@@ -24,6 +24,7 @@ RUN set -eux; \
         libzip-dev \
         mariadb-client \
         nginx \
+        openssl \
         pkg-config \
         redis-tools \
         unzip \
@@ -46,6 +47,8 @@ RUN set -eux; \
     rm -rf /var/lib/apt/lists/*
 
 COPY services/nginx/app/ /var/www/html/
+COPY scripts/bird-control-plane-activate.php /var/www/html/scripts/bird-control-plane-activate.php
+COPY scripts/bird-control-plane-auto-activate.php /var/www/html/scripts/bird-control-plane-auto-activate.php
 COPY services/php/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 COPY services/php/php-fpm-pool.conf /usr/local/etc/php-fpm.d/zz-pleno-workers.conf
 COPY services/coolify/api/nginx.conf /etc/nginx/nginx.conf
@@ -61,6 +64,8 @@ RUN set -eux; \
     fi; \
     COMPOSER_ALLOW_SUPERUSER=1 composer dump-autoload --no-dev --optimize --no-interaction -d /var/www/html; \
     php -d display_errors=1 -r 'require "/var/www/html/vendor/autoload.php"; exit(interface_exists("Psr\\Http\\Message\\UriInterface") && interface_exists("Psr\\Http\\Message\\StreamInterface") ? 0 : 1);'; \
+    php -r 'exit(function_exists("proc_open") && extension_loaded("openssl") ? 0 : 1);'; \
+    test "$(openssl pkey -pubin -in /var/www/html/modules/bird/resources/control-plane-bootstrap-public.pem -outform DER | sha256sum | cut -d " " -f 1)" = "6dc63c6ffe33b8de0b1396d7f529f56aea0a685ef98168016161cf721ddc8c21"; \
     chown -R www-data:www-data /var/www/html; \
     chmod -R 755 /var/www/html