refactor(orchestrator): rename control_plane module to server

orchestrator/control_plane.py -> orchestrator/server.py. Within the
orchestrator package the "control_plane" filename stutters (the
orchestrator *is* the control plane), and `orchestrator.server` reads as
"the orchestrator's HTTP server", pairing with service.py (domain logic)
and matching gateway/supervisor/server.py.

Scope is the module name only. The class ControlPlaneServer, the
CONTROL_AUTH_HEADER constant, and the "control plane" architectural term
(CONTROL_PLANE_PORT, host_control_plane_token, control_plane_url, …) are
deliberately unchanged — that's the load-bearing control-plane/data-plane
distinction. Test file renamed to match; full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/control_auth.py

@@ -15,8 +15,8 @@ Only the orchestrator (and the host CLI, which shares the host trust domain)
 holds the signing key; the gateway is handed a pre-minted ``gateway`` token it
 cannot rewrite into a ``cli`` token. So a compromised data-plane process can no
 longer approve its own supervise proposals or drive operator routes — it can
-only present the ``gateway`` role it was issued (control_plane rejects it on
-operator routes with 403).
+only present the ``gateway`` role it was issued (the control plane rejects it
+on operator routes with 403).
 
 Stdlib-only (HMAC-SHA256 over a JSON payload); no JWT dependency — the project
 carries no runtime pip deps. Tokens are **signed, not encrypted** (the role is