refactor(entrypoint): move route registry into entrypoint context

Replace global routes registry with entrypoint-scoped pools and
context lookups, and centralize API/metrics startup in config state.

internal/acl/config.go

@@ -74,8 +74,6 @@ type ipLog struct {
 	allowed bool
 }
 
-type ContextKey struct{}
-
 const cacheTTL = 1 * time.Minute
 
 func (c *checkCache) Expired() bool {

internal/acl/types/acl.go

@@ -0,0 +1,9 @@
+package acl
+
+import "net"
+
+type ACL interface {
+	IPAllowed(ip net.IP) bool
+	WrapTCP(l net.Listener) net.Listener
+	WrapUDP(l net.PacketConn) net.PacketConn
+}

internal/acl/types/context.go

@@ -0,0 +1,16 @@
+package acl
+
+import "context"
+
+type ContextKey struct{}
+
+func SetCtx(ctx interface{ SetValue(any, any) }, acl ACL) {
+	ctx.SetValue(ContextKey{}, acl)
+}
+
+func FromCtx(ctx context.Context) ACL {
+	if acl, ok := ctx.Value(ContextKey{}).(ACL); ok {
+		return acl
+	}
+	return nil
+}