…until a provider lands)

…lers

- Change handle_transition parameter from std::string to std::string_view
  (performance-unnecessary-value-param: parameter was only read, not modified)
- Replace std::move on trivially-copyable http::NoContent with direct
  construction via std::make_pair(http::NoContent{}, std::move(att))
  (performance-move-const-arg: move on trivial struct is a no-op)

Replace non-fatal EXPECT_TRUE + unconditional value() access with an
ADD_FAILURE guard that returns an empty json on error, eliminating UB
(empty tl::expected dereference) on a failing path.

Add GET:/api/v1/{apps,components}/*/status to VIEWER, OPERATOR, CONFIGURATOR lists.
Add PUT:/api/v1/{apps,components}/*/status/* to OPERATOR and CONFIGURATOR lists.
ADMIN is already covered by PUT:/api/v1/**.

Add test_lifecycle.test.py: launch_testing integration test exercising
GET /apps/{id}/status and GET /components/{id}/status (expects "ready"
for online entities) and PUT /apps/{id}/status/restart (expects 501
when no lifecycle provider registered). Host component id resolved
dynamically via GET /components items[0]. REQ_INTEROP_076 marked
verified.

Add design/lifecycle.rst covering the 6 status/lifecycle routes
(GET status + 5 PUT transitions for apps and components), status
read semantics per entity type, the LifecycleProvider seam, and
error mapping (403/409/501). Note that REQ_INTEROP_076 is verified
and 077-081 remain open until a substrate plugin lands.

Add lifecycle to the gateway design toctree. Update README with
the new endpoint list and a SOVD compliance table.

…es and cover provider-present path

- Add .response(202, ...) to all 10 PUT transition routes (apps + components)
  so the published OpenAPI reflects the actual 202 Accepted response instead
  of the default 200 from the DTO template.
- Add .operation_id(...) to all 12 lifecycle routes (2 GET + 10 PUT) following
  the camelCase verb+Entity+Resource pattern used throughout rest_server.cpp.
- Fix misleading comment claiming PUT/GET ordering prevents shadowing; GET and
  PUT are different methods and cannot shadow each other.
- Add LifecycleHandlersWithProviderTest fixture with 3 new test cases covering
  the provider-present handler path: URI filling on GET status, 202+Location on
  accepted transition, and 409 mapping for PreconditionFailed provider errors.

The lifecycle status routes are tagged "Lifecycle" but the tag was not
registered in the global OpenAPI tags array, so the tag-consistency check
in the health integration test failed.

- Resolve LifecycleProvider via an extern "C" get_lifecycle_provider query in
  the plugin ABI instead of dynamic_cast across the dlopen boundary, where RTTI
  is unreliable - a real provider could cast to null and silently never
  register, leaving lifecycle control at 501 forever.
- Derive Component readiness from a real liveness signal: the host Component is
  ready while reachable; any other Component is ready when at least one hosted
  App is online. host_metadata is only a host marker, not a liveness signal.
- Map a provider's EntityNotFound to 404 entity-not-found instead of a 500
  plugin-error.
- Validate the provider-supplied status against {ready, notReady} before
  writing it, guarding the SOVD contract against a misbehaving plugin.
- Gate the destructive shutdown / force-shutdown transitions behind the
  configurator role; operator keeps start / restart / force-restart.
- Add the <optional> include to the lifecycle DTO, scope the RBAC status
  comments to apps and components, and assert exactly one host Component in the
  integration test.
- Document the status and transition endpoints in docs/api/rest.rst.
- Tests for the provider ABI path, component liveness, the 404 mapping, the
  invalid-status guard, and the per-transition RBAC.