feat(federation): federate_aws — assertion + AssumeRoleWithWebIdentity + STS XML

[alukach]

Part of the Federated backend authentication epic (proxy-side).

What

Implement federate_aws: mint a short-lived OIDC assertion and exchange it for temporary AWS credentials via AssumeRoleWithWebIdentity.

Steps

1. Sign an RS256 assertion with the existing JwtSigner (config.oidc.signer): iss = OIDC issuer, aud = connection audience, sub = rendered subject, short TTL (~5 min), jti.
2. reqwest POST to sts.<region>.amazonaws.com:
   Action=AssumeRoleWithWebIdentity&RoleArn=<arn>&WebIdentityToken=<jwt>&DurationSeconds=<n> (optionally &Policy=<session policy>). No SigV4 — the web-identity token is the auth.
3. Parse the XML <Credentials> block (reuse the STS-XML parsing pattern from source.coop).

async fn federate_aws(signer, subject, audience, role_arn, duration, session_policy: Option<String>)
    -> Result<TempCreds, ProxyError>

Notes

• multistore-sts is the proxy's own STS (Layer 1) — this is a separate AWS client.
• The RSA OIDC key already produces RS256, which AWS web identity accepts.

Acceptance

• Returns {access_key_id, secret_access_key, session_token, expiration}
• STS error XML mapped to a ProxyError (no secret leakage in logs/messages)
• Unit test against a mocked STS response (valid + error)

[alukach]

✅ Validated by the PR #145 spike

The /_test endpoint (src/federation_test.rs on spike/federation-test-endpoint) ran this exact flow against a real AWS account and returned green:

mint_token : ok
sts        : ok   AssumeRoleWithWebIdentity → ASIAW3EL… (temp creds), expiration set
s3_list    : ok   200 → ["aschild_verify.txt"]   (alukach-demo-bucket, us-west-2)
role       : arn:aws:iam::…:role/test-data-source-coop-oidc
sub        : scv1:conn:test:federation-spike  (matched the trust policy :sub condition)

federate_aws is the productionized form of the spike's token-mint + assume_role: take (role_arn, audience, subject, duration), sign with the existing JwtSigner, POST AssumeRoleWithWebIdentity, parse the XML credentials. The spike's hand-rolled SigV4 list stays in the spike — production listing goes through multistore once #142 wires the credentials into backend_options.

Dependencies: none — ✅ ready to start (productionize directly from the spike).

[alukach]

Reshaped by developmentseed/multistore#56. Instead of hand-rolling the STS request + XML parse, this consumes multistore-federation:

• build the request with aws::AssumeRoleWithWebIdentity (incl. optional session_policy),
• perform the HTTP via the worker runtime (the crate is runtime-agnostic — caller owns transport),
• parse with aws::parse_response → FederatedCredentials.

The proxy still owns policy: minting the OIDC assertion (via multistore-oidc-provider) and the subject / audience it carries.

Dependency: awaiting the upstream multistore-federation release (exchange primitive implemented on branch feat/backend-federation). Intentionally not pinning the dev branch.