feat: expose realtime provider status (COD-426)

[shivros]

Summary

• add side-effect-free GET /status beside /health
• expose a provider-level realtime lifecycle snapshot, including Telegram terminal errors and timestamps
• cover hub lifecycle reporting and status response JSON

Verification

• cargo build --all-targets
• cargo test --all-targets (164 tests)
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check

Closes COD-426.

[shivros]

🤖 Automated Review Panel

GPT-5.6 Terra

APPROVE. /status returns the required per-provider fields while preserving /health; Telegram reads only an existing OnceLock hub, so the endpoint neither initializes realtime infrastructure nor performs polling/network I/O. Lifecycle/error timestamp behavior and the added handler/hub coverage align with COD-426.

---

Independent reviewer

APPROVE. Reviewed the branch diff for goal alignment and correctness. No blocking issues found. The realtime snapshot is side-effect-free, JSON states serialize as required, and terminal error/status reporting is covered.

[shivros]

Auto-Merge Gate rationale

Confidence: 0.89

COD-426's runner-ready acceptance criterion is a side-effect-free /status endpoint exposing per-provider realtime state, last error/timestamp, and subscriber count. This PR implements that contract through an additive provider status interface, reads the existing Telegram hub without initialization or I/O, and adds lifecycle plus JSON handler coverage.

Observed required checks: Test, Format Check, Clippy, Secret Scan, Dependency Audit, and Creed context drift — all successful. The dual-review panel found no blocking issues. Scope is limited to the Iris realtime status path; this gate did not treat the issue's broader future health-degradation proposal as part of this PR's explicit acceptance criterion.