feat: complete agent operator read surface

[yairfalse]

Summary

• expose admin read endpoints for circuit breakers, rate limiters, listeners, and metrics
• wire RemoteGatewayQuery and CLI metrics/backend health through real admin calls
• return explicit unavailable errors for drain/undrain until safe actions are implemented
• add fake GatewayQuery coverage for all MCP tools

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• Teko work rauta-agentic-surface verified and closed