feat!: replace mTLS streams with token-auth HTTP polling

[crisog]

Summary

This PR migrates worker-control-plane communication from stream + mTLS to HTTP polling + bearer-token auth, reducing operational complexity and making deployments easier to scale.

Key Changes

• Replaced WorkerStream with polling RPCs: GetJobs, SubmitResult, and RenewLease.
• Updated enrollment flow to return api_token + api_endpoint; removed CSR/certificate exchange.
• Removed PKI/mTLS code paths and added token-based worker auth with caching.
• Added operational improvements in control plane:
  • worker inactivity monitor
  • lease reaper integration for polling model
  • batched done-job cleanup
  • DB pool tuning via env vars
• Added migrations for worker API tokens and certificate-field removal.
• Regenerated protobuf/connect code and updated tests/docs to match the new model.