Validate provider config at distribution registration

Problem

Today, registering a Distribution against an endpoint with no matching S3StorageProvider entry succeeds silently. The failure surfaces only later — when a consumer requests credentials via ?include_storage_options=true, FileAccessService logs a warning ("No credential provider configured for endpoint") and returns no token. The user sees an empty storage_options field with no obvious explanation, and the admin had no idea a new endpoint was needed.

For public datasets this is fine: anonymous access doesn't go through the provider, so silent absence is correct. For embargoed/restricted datasets it's a footgun.

Proposed

At distribution registration time:

1. If access_level is public, no validation needed.
2. If access_level is embargoed or restricted, look up the provider config for the distribution's endpoint_url. If none matches, reject with a 400 explaining that this endpoint is not configured for credential vending and the admin must add it to FDS_STORAGE_PROVIDERS.

This makes the admin-coordination requirement explicit at the seam where it actually matters.

Notes

• Same check applies on Distribution updates that change endpoint_url or access_level.
• Inheritance: the effective access level (Dataset → Shot → Device) determines whether the check fires, not just the literal field on the distribution.
• See app/services/dataset_service.py (Distribution creation) and app/core/storage/providers.py:get_provider_for_endpoint for the relevant code paths.

Governing ADR(s): ADR 0002, ADR 0021

Migrated from the internal tracker, where it was #11, opened 2026-04-29.

Start in app/services/dataset_service.py at Distribution creation and update handling, then read app/core/storage/providers.py:get_provider_for_endpoint. Trace how effective access level is inherited from Dataset, Shot, and Device, and verify the existing credential-vending behavior. Done means public distributions remain unaffected, restricted or embargoed distributions reject unconfigured endpoints with the specified 400, and endpoint or access-level updates apply the same check.