Epic: Federated backend authentication (proxy-side — federation client + caching)

Epic: Federated backend authentication — proxy-side

Enable the source-data-proxy worker to communicate with private storage backends by federating its OIDC identity into customer-owned roles at request time, replacing the current skip_signature / anonymous_access path. This epic covers the proxy (Rust/Cloudflare Worker) half; the app/API/UI half lives in source-cooperative/source.coop (see its companion epic).

Why

src/registry.rs resolves the backend bucket/region/prefix but tells multistore not to sign:

// TODO: For authenticated users, provide real backend credentials ...
backend_options.insert("skip_signature".to_string(), "true".to_string());
// ...
anonymous_access: true,

So every private backend is unreachable. multistore's BucketConfig.backend_options already accepts access_key_id / secret_access_key / session_token — we just need to populate them with federated credentials.

Flow

1. Layer-1 caller authz (must precede federation — confused-deputy guard)
2. resolve_product → role ARN + audience + subject_scope (no secret)
3. Mint RS256 assertion (iss=https://data.source.coop, aud=<const>, sub=<rendered>)
4. AssumeRoleWithWebIdentity at sts.<region>.amazonaws.com (web-identity token is the auth — no SigV4 on the STS call)
5. Signed backend_options; multistore streams
6. Cache creds keyed by rendered subject; refresh-ahead + single-flight

Subject contract

Versioned, structured sub (AWS trust policies can only condition on :aud/:sub):
scv1:conn:{id} | scv1:conn:{id}:account:{acct} | scv1:conn:{id}:product:{acct}/{product}.
subject_scope is per-connection so the shared connection caches one credential.

Reference

Design doc: source.coop/docs/plans/2026-06-02-federated-backend-auth-design.md (local working doc).

Start with the local design document at source.coop/docs/plans/2026-06-02-federated-backend-auth-design.md, then inspect src/registry.rs and its current skip_signature and anonymous_access handling. The work is complete when the proxy follows the documented authorization, assertion, STS federation, credential caching, and signed backend-options flow.