refactor: unify component naming — control_plane/control_auth -> orchestrator

The codebase used "control plane" both as an architectural role term AND
as an identifier alias for the orchestrator component, producing
duplicate names for one thing (control_plane_url vs orchestrator_url,
CONTROL_PLANE_PORT, host_control_plane_token, …). Going forward the
concrete component is always named for what it is — Gateway or
Orchestrator — and the plane vocabulary is reserved for prose (module
descriptions, the security argument).

Renamed (identifiers + the in-repo env/wire/file string values, all
setters/getters are in this repo so the change is atomic):

  ControlPlaneServer            -> OrchestratorServer
  control_plane_url             -> orchestrator_url
  probe_control_plane_url       -> probe_orchestrator_url
  host_control_plane_token      -> host_orchestrator_token
  CONTROL_PLANE_PORT            -> ORCHESTRATOR_PORT
  CONTROL_PLANE_TOKEN_ENV/FILE  -> ORCHESTRATOR_TOKEN_ENV/FILENAME
  BOT_BOTTLE_CONTROL_PLANE_TOKEN-> BOT_BOTTLE_ORCHESTRATOR_TOKEN
  control-plane-token (file)    -> orchestrator-token

  control_auth (module)         -> orchestrator_auth  (stays top-level;
                                   the gateway imports it and must not
                                   import the orchestrator/ package)
  CONTROL_AUTH_HEADER           -> ORCHESTRATOR_AUTH_HEADER
  x-bot-bottle-control-auth     -> x-bot-bottle-orchestrator-auth
  CONTROL_AUTH_JWT_ENV          -> ORCHESTRATOR_AUTH_JWT_ENV
  BOT_BOTTLE_CONTROL_AUTH_JWT   -> BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT
  _control_auth_headers         -> _orchestrator_auth_headers

Prose plane-terms ("control plane", "data plane") are preserved,
including the test name test_data_plane_daemons_get_jwt_not_key (it
names the security invariant). Gateway and orchestrator verified to
agree on the renamed wire header; full unit suite green (2243).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/integration/test_orchestrator_docker_auth.py

@@ -25,10 +25,10 @@ import tempfile
 import unittest
 from pathlib import Path
 
-from bot_bottle.control_auth import ROLE_CLI, ROLE_GATEWAY, mint
+from bot_bottle.orchestrator_auth import ROLE_CLI, ROLE_GATEWAY, mint
 from bot_bottle.orchestrator.client import OrchestratorClient
 from bot_bottle.backend.docker.infra import DockerInfraService
-from bot_bottle.paths import host_control_plane_token
+from bot_bottle.paths import host_orchestrator_token
 from tests._docker import skip_unless_docker
 
 # Fixed (not per-run-suffixed) so repeated runs reuse the same layer-cached
@@ -46,20 +46,20 @@ _TEST_INFRA_IMAGE = "bot-bottle-infra:itest"
     "runner's /workspace — same host-bind-mount constraint as the other "
     "bottle-bringup integration tests",
 )
-class TestDockerControlPlaneAuthIntegration(unittest.TestCase):
+class TestDockerOrchestratorAuthIntegration(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
         suffix = secrets.token_hex(4)
         cls._tmp = tempfile.TemporaryDirectory()  # pylint: disable=consider-using-with
         cls.addClassCleanup(cls._tmp.cleanup)
 
-        # host_control_plane_token() — both the token read below and the one
+        # host_orchestrator_token() — both the token read below and the one
         # DockerInfraService injects into the container's env — resolves its
         # path via the *ambient* BOT_BOTTLE_ROOT env var, not the host_root
         # kwarg passed to the constructor (that kwarg only controls the DB
         # bind-mount destination). Without pointing the env var at the same
         # throwaway dir, this "isolated" test would read/write the developer's
-        # real ~/.bot-bottle/control-plane-token.
+        # real ~/.bot-bottle/orchestrator-token.
         previous_root = os.environ.get("BOT_BOTTLE_ROOT")
 
         def _restore_root() -> None:
@@ -88,7 +88,7 @@ class TestDockerControlPlaneAuthIntegration(unittest.TestCase):
         cls.svc.ensure_running()
         # The control plane now verifies role-scoped signed tokens, not the raw
         # key. Mint one of each role from the host signing key (issue #469 review).
-        signing_key = host_control_plane_token()
+        signing_key = host_orchestrator_token()
         cls.cli_token = mint(ROLE_CLI, signing_key)
         cls.gateway_token = mint(ROLE_GATEWAY, signing_key)