feat: harden authorization and admission with CEL request policies

[St4NNi]

Hardens the authorization and admission surface across REST, S3, replication and document sync, and adds realm and group scoped CEL request policies that are evaluated after authorization and before execution on both planes.

Changes

• Anchor permission path matching so a single star no longer crosses a path separator, and cap token restrictions at issuance.
• Confine group role path patterns to the owning group subtree.
• Hide metadata existence from unauthorized callers on read by id, including records made unreadable by a policy.
• Bind replication and document sync admission to the authenticated peer, check eligibility before the stream is drained, and add per peer and global byte budgets.
• Record the authenticated publisher node on replicated versions instead of trusting caller supplied manifest context.
• Purpose bind the initial administrator claim, seal the onboarding secret, and hash OIDC subject index keys.
• Keep S3 credentials issuer local and seal the secret at rest with a node derived key.
• Add a reachable bearer token revocation surface: a replicated realm wide revocation set, an authorized revoke route restricted to the token owner or a user administrator, and expiry bounded pruning.
• Add per principal and per address rate limiting with 429 and Retry-After on REST and SlowDown on S3, bound S3 connection and request concurrency, and make the quotas configurable.
• Honor forwarded headers only from trusted proxies on both REST and S3, and refuse scheme downgrading egress redirects.
• Add realm and group scoped CEL request policies with deny and require kinds, a when guard, request body and parameter context, compiled program caching, fail closed evaluation, and validate, dry run and effective policy endpoints.
• Route REST and S3 authorization through one policy boundary, covering bulk metadata reads, secondary S3 resources such as copy sources and replication targets, and operation owned routes.
• Add a generic audit read endpoint that fans out across realm metadata nodes concurrently, derives completeness from configured membership, and reports missing nodes instead of a complete looking partial result.
• Authorize the realm user directory reads and the stored request policy reads, which previously performed no permission check.
• Add a guard test asserting every route performs an authorization check, with an explicit reasoned allowlist for the deliberately public and self scoped surfaces.
• Make operation transaction ownership reliable: terminal failures and cancelled drives abort or hand off their transactions at every effect boundary, storage tracks pending cleanup with bounded abort retries, and queued cleanup work no longer races caller aborts into spurious transaction not found errors.
• Re-validate metadata registry state inside the write transaction for update and delete, with ULID fenced registry and sidecar writes, so concurrent interleavings cannot resurrect deleted documents or record stale tombstone fences.
• Persist blob reservations and upload cleanup obligations so cancelled, failed, or ambiguous writes release capacity and staged data instead of leaking them.

References

Closes #440
Closes #443
Closes #336
Closes #337

Partially addresses #346: only the scheme downgrading redirect refusal and the trusted proxy boundary land here.

[codecov]

Codecov Report

❌ Patch coverage is 81.89367% with 1570 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.96%. Comparing base (f97c801) to head (3b5faf8).

Files with missing lines	Patch %	Lines
blob/src/blob/io.rs	63.25%	341 Missing ⚠️
blob/src/blob/backend.rs	60.85%	256 Missing ⚠️
operations/src/driver.rs	78.71%	179 Missing ⚠️
operations/src/blob/hidden.rs	79.80%	166 Missing ⚠️
api/src/s3/s3_server.rs	87.54%	114 Missing ⚠️
operations/src/jobs/export.rs	89.03%	102 Missing ⚠️
operations/src/incoming.rs	36.73%	62 Missing ⚠️
net/src/dht/driver.rs	40.90%	52 Missing ⚠️
blob/src/blob/replication.rs	13.20%	46 Missing ⚠️
net/src/streams.rs	88.69%	45 Missing ⚠️
... and 31 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #447      +/-   ##
==========================================
+ Coverage   86.54%   86.96%   +0.42%     
==========================================
  Files         359      377      +18     
  Lines      210658   243671   +33013     
==========================================
+ Hits       182304   211910   +29606     
- Misses      28354    31761    +3407     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.