#3241 fix(controlplane): stop exposing pprof /debug endpoints on public listeners

Summary

The controlplane exposed Go pprof /debug/pprof/* endpoints, unauthenticated, on the public API and metrics HTTP listeners regardless of the enable_profiler setting.

The cause is a combination of two behaviors:

• The net/http/pprof blank import registers its handlers on the process-wide http.DefaultServeMux at init time.
• go-kratos sets every HTTP server's NotFoundHandler (and MethodNotAllowedHandler) to http.DefaultServeMux, so any unmatched route falls through to those pprof handlers. The kratos auth/RBAC middleware does not run on that fall-through path.

As a result /debug/pprof/* was reachable on the public API port and the metrics port even with enable_profiler: false.

Changes

• Add hardenedRouteOptions() which overrides NotFoundHandler/MethodNotAllowedHandler with plain 404/405 responses so no kratos HTTP server falls through to http.DefaultServeMux. Applied to the main API server, the metrics server, and the profiler server.
• Register the pprof handlers explicitly on the opt-in profiler server's own router (private mux) instead of relying on the default-mux fall-through.
• Remove the net/http/pprof blank imports from the controlplane entrypoint.

With these changes pprof is unreachable when profiling is disabled, and when enabled it is served only on the dedicated profiler port.

AI assistance

This change was produced with assistance from Claude Code.