Mirrors #204's bindings migration: replaces require_admin_key and
router-level require_api_key with require_operation(CONTROLS_*) on
every protected route on /controls and on /control-templates/render.
Both routers now mount with the non-validating
get_api_key_from_header so the framework owns authentication and
authorization, with the extractor attached purely so the generated
OpenAPI advertises X-API-Key.

GET /controls/schema is intentionally left without a
require_operation dependency: it returns a static model schema with
no tenant state and routing it through the framework would force the
upstream provider to handle a meta-only operation that has no
permission semantics.

POST /controls/validate and POST /control-templates/render are wired
to CONTROLS_CREATE rather than CONTROLS_READ. Both exercise the
authoring materialization path and exist to support the create / set-
data flow; a caller who cannot create controls has no use for the
result. Backwards-incompatible for OSS deployments that previously
called these routes with non-admin keys; deployments that want the
old behavior can override with
HeaderAuthProvider(operation_access={...}).

Storage namespace continues to come from get_namespace_key, matching
the bindings migration in #204. The unified principal-derived cutover
across /controls, /policies, /agents, and /evaluation is a follow-up.