Move ingress provider env wiring behind adapter

[cbusillo]

Summary

• move default NPMplus ingress env/client construction behind the ingress provider adapter
• keep service-level test injection compatibility for fake NPMplus clients
• add provider module tests for fail-closed missing env and default provider identity
• update driver development docs to name the adapter as the credential construction boundary

Refs #1065
Refs #1041

Validation

• git diff --check
• uv run --extra dev ruff check control_plane/workflows/ingress_provider.py control_plane/service.py tests/test_ingress_provider.py
• uv run python -m unittest tests.test_ingress_provider tests.test_npmplus_ingress_workflow tests.test_ingress_cli tests.test_service.LaunchplaneServiceTests.test_npmplus_ingress_route_apply_dry_run_returns_plan_without_mutation tests.test_service.LaunchplaneServiceTests.test_npmplus_ingress_route_apply_mutates_when_authorized tests.test_service.LaunchplaneServiceTests.test_ingress_route_apply_uses_provider_adapter tests.test_service.LaunchplaneServiceTests.test_npmplus_ingress_route_apply_fails_before_mutation_when_audit_unavailable tests.test_service.LaunchplaneServiceTests.test_npmplus_ingress_route_apply_requires_idempotency_key tests.test_service.LaunchplaneServiceTests.test_npmplus_ingress_route_apply_rejects_unauthorized_context
• uv run python -m unittest tests.test_ingress_provider tests.test_generic_web_deploy