feat(federation): optional per-product inline session policy

[alukach]

Part of the Federated backend authentication epic (proxy-side).

What

For connections using subject_scope = product, optionally pass an inline session policy on AssumeRoleWithWebIdentity that scopes the session to {base_prefix}{mirror_prefix}*. This adds a proxy-side blast-radius control on top of the customer's trust policy.

Why it's "free" here

A product-scoped connection already pays per-product cache cardinality, so adding a per-product session policy doesn't change the cache key class. For connection/account scope, mint no session policy (keeps the credential broad and cacheable) — the Source-owned bucket relies on Layer-1 authz + path-prefix rewriting instead.

Acceptance

• product scope → session policy scoping to the product prefix
• connection/account scope → no session policy
• Session-policy fingerprint included in the cache key
• Test: session policy denies access outside the product prefix

[alukach]

Blocked by: #142.

[alukach]

Simplified by developmentseed/multistore#56. The session policy is now just the session_policy field on multistore_federation::aws::AssumeRoleWithWebIdentity — no separate machinery to build. Still applies only for product scope. Blocked by #142.

[alukach]

Deferred — blocked on an upstream multistore seam, and entangled with #139 + the design pivot. No proxy-side PR now; details so it's actionable when unblocked.

The capability exists upstream but isn't reachable per-request. multistore-oidc-provider 0.6.2 src/exchange/aws.rs has AwsExchange { session_policy: Option<String>, .. }, which becomes the STS Policy parameter on AssumeRoleWithWebIdentity. But the OIDC middleware (src/backend_auth.rs) builds the exchange per request from oidc_role_arn only — it does not read any session-policy from backend_options, and the cache key carries no policy fingerprint. So the proxy has no seam to inject a per-product policy: today it could only set one static policy for the whole middleware, which defeats the per-product intent.

Needed upstream change (developmentseed/multistore) before this can be wired here:

1. Middleware reads a per-request session policy (e.g. oidc_session_policy) from backend_options → AwsExchange.session_policy.
2. Fold a policy fingerprint into the credential cache key (so two products sharing a role but differing policies don't collide). Re: acceptance item "session-policy fingerprint included in the cache key" — that's an upstream cache-key concern, not proxy code.

Other blockers / re-framing needed:

• Depends on feat(federation): versioned subject contract + render_subject(subject_scope) #139 (versioned subject contract / render_subject), still open — the proxy needs to render the product-grained subject before a per-product policy makes sense.
• Premise partially obsoleted by the design pivot (source.coop#377, 2026-06-22): this issue is framed around subject_scope = product vs connection/account, but the pivot dropped the per-connection scope/cache_level selector — the subject is now always product-grained. So "product scope → policy; connection/account scope → no policy" no longer maps to a configurable scope. The policy / no-policy decision needs re-deciding under the fixed product-grained model (likely: Source-owned buckets → no policy; customer buckets → per-product policy, keyed off owner).
• The "denies access outside the product prefix" acceptance test requires a live AWS target (same harness as tests/test_federation.py).

Recommendation: keep open, blocked. Sequence: land the upstream multistore seam + #139, settle the policy/no-policy rule against the post-pivot model, then a small proxy PR renders the policy JSON from {base_prefix}{mirror_prefix}* and inserts oidc_session_policy into backend_options.