[fix] expose browser-safe control-plane endpoints

[FlowmemoryAI]

Summary

• add CORS headers for the local control-plane HTTP server so the Vite workbench can fetch it from port 5173
• add GET /state mapped to the existing devnet_state method because the workbench already probes that endpoint
• add HTTP server test coverage for /health, /state, and CORS headers

Validation

• npm test --prefix services/control-plane
• live local header probe for /health and /state from Origin http://127.0.0.1:5173
• git diff --check