feat(axum): add safe diagnostics and trusted proxy metadata

[ChristianPavilonis]

Summary

• Add opt-in, socket-peer-gated proxy trust and checked native ingress metadata. No proxies are trusted by default; managed admission strips both forwarding families.
• Add safe correlated native records, request IDs, coherent work snapshots and an optional observer at the existing response terminal owner. Preserve application logging, completions, observers and custom rendering.
• Use fixed native framework routing and JSON-deserialization error text, publish operator guidance, and add real proxy/TLS/socket regression coverage.

Changes

Crate / file	Change
edgezero-adapter-axum	Bounded literal policy/parser, owned metadata, strict settings, identity/counters/records, hosting integration and selected-status capture
edgezero-core	Checked host witness, original normalized-head summary, timestamp-aware joined completion and bounded failure provenance; no report-shape or portable Tokio/Send change
Native fixtures	Source-bound .2/.3 relays, verified test TLS with wrong-name control, 32 production-hosting cases, callback/panic/privacy/counter checks and defensive fallback tests
Docs	Operator/migration guide, immutable reviewed specification and implementation/acceptance record

The approved JSON extension retains HTTP 400 and unmanaged serde detail. Custom renderers still own their response, but native framework JSON-deserialization errors now reach them as invalid JSON payload. Application-authored EdgeErrors are not globally sanitized. Managed raw-forwarding-header removal is documented as a compatibility change; the low-level converter remains a trust-policy bypass.

Dependency changes are four direct Axum edges to existing locked packages. Rustls and Tokio Rustls are dev-only. The published TLS private key is an explicitly public test asset, never a deployment credential.

Closes

Closes #397.

Stack and acceptance

Part of #391. This PR remains draft until the required integration and acceptance gates are satisfied.

Stacked above #407 using gh stack, at base 3308041b910b648af746c15e809ee86b96adc2e9. The user authorized implementation on this open stack. That exception does not satisfy accepted #275/#393 integration or authorize bypassing #394/#395 upload experiments. Accepted-stack, final-image and deployed-ingress acceptance remain deferred.

Test plan

Local checks passed for implementation commit 66a05e2:

• cargo test --workspace --all-targets — 1,938 passed, one existing ignored generated-workspace compile smoke
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check and git diff --check
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• All three adapter WASM checks: Fastly wasm32-wasip1, Cloudflare wasm32-unknown-unknown, Spin wasm32-wasip2
• cargo test -p edgezero-adapter-axum --all-targets --all-features — 255 library, 13 contract and 32 hosting cases
• cargo test -p edgezero-core — 731 library tests plus integrations/doctests; 13 existing ignored doc examples
• Locked docs install, lint, format and build; compiled guide API/options/snapshot smoke
• Excluded examples/app-demo workspace
• Final image and deployed proxy/provider acceptance

docs/superpowers/plans/2026-10-06-axum-diagnostics-trusted-proxy.md records commands, timings, historical failures, source fingerprints, all 22 specification rows and proof boundaries. Final runtime-input manifest SHA256: ac40934b17bb6c521951f15090e2accf3059abcb4d386c6da74a69d95de8c9d7.

Local wire tests directly prove owned proxy peers, consumer agreement, verified TLS, selected 200 plus failure after an observed head/prefix, hook/cardinality preservation and graceful/grace-forced work release. Missing-peer, exhaustive parser/identity bounds, precise injected timing and defensive fallback branches remain service/unit evidence. Environment-derived secret/config error privacy is tested; declared-store/backend and actual outbound-origin experiments are not claimed. Explicit diagnostic stop fixtures do not prove the convenience second-signal-plus-native-snapshot combination. The existing supported convenience second-signal test is retained.

Independent source reviews found and resolved lost Abort failure classification and formatting drift. A maintenance-only duplicated IPv6 bracket split remains unchanged; node and authority port grammars differ. Docs installation reports seven existing audit vulnerabilities, two moderate and five high; no docs package changes were made.

Checklist

• Follows CLAUDE.md; shared Cargo/global formatting centrally scheduled
• No portable Tokio dependencies or Send migration
• Brace-style route parameters and core HTTP types
• No exporters, public diagnostics endpoints, tracing propagation or new terminal owner
• Application hook/logger/renderer ownership preserved
• Test keys are explicitly public fixtures; no deployment secrets committed
• Distinguish local proof from downstream acceptance; keep the PR draft until its merge gates are satisfied