Broker only: prove control API authentication and database readiness

Internal broker only; excluded from public SDK methods. Requires the configured dedicated broker bearer and a successful database check. Works while HOSTED_GATEWAY_TCP_ENABLED is false; ready:true grants no traffic authority. The broker caches a successful probe at most 10 seconds and expires readiness proof after 30 seconds; authentication refusal invalidates it immediately. Strict empty JSON, 4096-byte bodies, 2000 requests/minute.