fix(training-agent): block app.listen() until tenant registry is ready

[bokelley]

Summary

Follow-up to #4060. That PR triggered eager init at module load but didn't gate the HTTP listener on init completing — the 6-tenant registration burst takes 30–60s on a fresh Fly machine, the post-deploy smoke runs at ~T+10s during the warmup window, and tenant routes return 500. Five consecutive deploys failed the smoke before this PR; production was healthy minutes later in every case.

Why eager init alone wasn't enough

HTTPServer.start() was structured as: build app → mount routes (eager init kicks off in background) → app.listen(). The eager init promise was fire-and-forget, so the listener bound immediately while registration was still in flight. Smoke probes during that window get 500 because resolveByRequest returns null for tenants in pending health, and downstream the route handler ends up at Express's default error handler.

What changed

• createTrainingAgentRouter() now returns { router, ready } instead of a bare Router. The ready Promise resolves when the registry is fully registered + validated.
• HTTPServer.start() awaits ready before app.listen(). The HTTP server simply doesn't bind to the port until tenants are healthy.
• Real init bugs (fix(training-agent): wire Postgres task registry — production hotfix #3854 in-memory task registry, fix(training-agent): drop noopJwksValidator production guard #3869 noopJwksValidator under NODE_ENV=production) now surface as a boot crash. Deploy rolls back. Better than the silent 500s-until-restart state.
• API change touches every test/script that boots the router: 5 integration tests, 1 manual test, 1 e2e script.

Test plan

• 371 training-agent unit/integration tests pass
• Typecheck clean
• Precommit hook passed
• After merge: deploy this PR, watch the post-deploy smoke step in the workflow run — should pass cleanly with all 6 tenant routes returning 401 (auth-rejected, not 500)
• After merge: subsequent unrelated deploys also pass smoke (confirms the fix is durable, not specific to this image)

🤖 Generated with Claude Code