Add a `BackendAuth` field to `DataConnectionDetails` (the Source API's
data-connection shape): `Unsigned` (default, public bucket) or
`S3WebIdentityRole { role_arn }` (federate the proxy's OIDC identity into a
customer role). `resolve_product` branches on it via `apply_backend_auth`:

- Unsigned  -> skip_signature (current behavior). Default, so every existing
  connection is unchanged since the API omits `authentication` for now.
- S3WebIdentityRole -> auth_type=oidc + oidc_role_arn + a per-connection subject
  (scv1:conn:{id}), leaving signing ON so multistore's OIDC backend-auth
  middleware injects the federated temporary credentials.

Replaces the long-standing `// TODO: provide real backend credentials` at the
forced `skip_signature` insert.

Not yet live: the federated branch needs the `MaybeOidcAuth` middleware wired
into dispatch (next step). Until then no connection sends `authentication`.

Note: the proxy lib is `cdylib` + `test = false` (wasm-only deps block native
compilation), so this logic isn't unit-tested; verified via
`cargo check/clippy --target wasm32`.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…ests

Move `BackendAuth`, `apply_backend_auth`, and `AWS_STS_AUDIENCE` out of
registry.rs into a new wasm-free `src/backend_auth.rs`, and add
`tests/backend_auth.rs` which includes it via `#[path]` — the lib is `cdylib`
with `test = false`, so this is the only way to natively unit-test it (mirrors
`tests/pagination.rs`).

The federation-critical logic was previously untested. Now covered: serde
round-trips (unknown type -> Unsupported, the s3_web_identity_role variant) and
the option-set translation for each variant. Pure move, no behavior change. Also
drops the stale "inert until the middleware is wired (next step)" doc note that
this branch already obsoleted.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The proxy parses the entire data-connection list in one `serde_json::from_str`,
so a single connection with a malformed `authentication` (null, wrong-typed, or
a known type missing required fields like `role_arn`) would fail the whole parse
and break resolution for *every* product. `#[serde(default)]` only covers an
absent field, not a present-but-invalid one.

Add a lenient `deserialize_with` on the field: a present value that doesn't
parse degrades to `Unsupported` (and `null` to `Unsigned`) instead of erroring,
so one bad connection can't poison the list. Covered by new tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The gateway (and its OIDC backend-auth middleware) are rebuilt on every fetch(),
so the provider's credential cache was discarded each request — every federated
request would re-mint a JWT and re-run AssumeRoleWithWebIdentity to the same
role. Hold the provider in an isolate-level OnceLock and clone it per request;
cloning shares the cache (enabled by the multistore
`feat/shareable-credential-cache` change this rev now pins), so repeat requests
reuse cached temporary credentials.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

`apply_backend_auth` previously served `Unsupported` (the app-side GCP/Azure
workload-identity variants, or a malformed `authentication`) as unsigned with a
per-request warning. Serving unsigned could expose an anonymously-readable
backend, and the warning spammed once per request for a misconfigured
connection. Return `ProxyError::BackendAuthError` instead — deny so the
misconfiguration surfaces explicitly (a connection that can't be authenticated
shouldn't be served at all).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

AWS STS returns its <ErrorResponse> document in the body on 4xx/5xx, and
multistore's parse_response reads the error from the body — so FetchHttpExchange
must return the body regardless of status. Add a comment so a future maintainer
doesn't "fix" it with error_for_status(), which would discard the diagnostic.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Add a `kind()` label to BackendAuth (unsigned / s3_web_identity_role /
unsupported — no secrets) and record it on the resolve_product span, so an
operator can see which backend-auth path a request took (and correlate a
fail-closed Unsupported or an STS 403) without leaking the role ARN.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

apply_backend_auth federates unconditionally, which can read as a missing
confused-deputy guard. Document that the guard is the subject-scoped Source API
fetch: the caller is authorized for the product/connection before resolution
reaches federation, so the proxy never mints a role token for data the caller
can't access.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>