@meta/ep-neon control service

The Neon control plane, as a service. Authenticated API (machine callers send a bearer token):

• POST /api/neon/v1/provision — create + warm a branch, run optional seed SQL (streaming)
• POST /api/neon/v1/reveal — reveal a branch DSN
• GET /api/neon/v1/branches?tenant=… — list branches
• /admin — the human portal (TODO: human-session auth)

Providers: in-house (VPC-only RELAY — needs a BYOF/VPC deploy) and lakebase (public Databricks; set DATABRICKS_*). Enable with NEON_ADMIN_ROUTE_ENABLED=1.