Cloud-readiness: deployment hygiene (health probes, CORS, tracing, config)

## Problem

Smaller items, but each one bites once the backend runs as multiple managed instances rather than one long-lived process.

**Env vars captured at module import time**
- `apps/rpg-maestro/src/app/auth/jwt-auth.guard.ts:9` — `ISSUER` / `JWKS_URL` / `JWKS` are resolved at import
- `apps/audio-file-uploader/src/app/fileUpload/FileUploadService.ts:3` and `.../UploadFromYoutubeService.ts:12-13`

Acceptable for containers, but it means no config reload and that misconfiguration surfaces as an import-time failure rather than through `checkValidConfig()` in `apps/rpg-maestro/src/config.ts`.

**`/health` does not distinguish readiness from liveness**
- `apps/rpg-maestro/src/app/health.controller.ts` and `apps/audio-file-uploader/src/app/app.controller.ts:24` both return a static `{ status: 'ok' }`

An instance whose Firestore connection is dead still passes the check and keeps receiving traffic. Needs a readiness probe that actually checks downstream dependencies, kept separate from liveness.

**Wildcard CORS on the uploader**
- `apps/audio-file-uploader/src/main.ts:11` — `enableCors({ origin: '*' })` with an existing `// TODO fix this`

The maestro backend already resolves its allowed origin properly (`app-bootstrap.ts`, via `NetworkingConfiguration`). The uploader should do the same, especially once it is separately internet-reachable.

**No request/trace correlation**

There is no correlation or trace id on requests or log lines, which makes debugging across N instances (and across the maestro → uploader hop) painful.

**No graceful shutdown**

Neither `apps/rpg-maestro/src/app-bootstrap.ts` nor `apps/audio-file-uploader/src/main.ts` calls `enableShutdownHooks()` or handles SIGTERM. Tracked in more detail in the ingestion-pipeline issue, but it applies to both apps.