fix(admin): admit iceberg fields in warehouse PUT strict-decode (#557)

PR #554 added the Iceberg fields to ManagedWarehouse (configstore) and
to the upsert column allowlist, but missed the strict-decode struct
managedWarehouseRequest that gates which top-level keys a PUT body may
carry. The doc comment on that struct literally warns: "If you add a
field here without a matching tag on ManagedWarehouse, strict decode
will accept it and the merge will silently drop it."

Without this fix, `PUT /orgs/<id>/warehouse` with `{"iceberg":{...}}`
returns 400 "unknown field iceberg" — making it impossible to enable
Iceberg via admin API on existing warehouses (the whole reason the
drift correction in #555 exists).

Adds the matching test mirroring TestPutWarehouseDisablesPgBouncerWhenSetToFalse.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: fuziontech

controlplane/admin/api.go

@@ -523,6 +523,7 @@ type managedWarehouseRequest struct {
 	MetadataStore                  configstore.ManagedWarehouseMetadataStore     `json:"metadata_store"`
 	PgBouncer                      configstore.ManagedWarehousePgBouncer         `json:"pgbouncer"`
 	S3                             configstore.ManagedWarehouseS3                `json:"s3"`
+	Iceberg                        configstore.ManagedWarehouseIceberg           `json:"iceberg"`
 	WorkerIdentity                 configstore.ManagedWarehouseWorkerIdentity    `json:"worker_identity"`
 	WarehouseDatabaseCredentials   configstore.SecretRef                         `json:"warehouse_database_credentials"`
 	MetadataStoreCredentials       configstore.SecretRef                         `json:"metadata_store_credentials"`
@@ -536,6 +537,8 @@ type managedWarehouseRequest struct {
 	MetadataStoreStatusMessage     string                                        `json:"metadata_store_status_message"`
 	S3State                        configstore.ManagedWarehouseProvisioningState `json:"s3_state"`
 	S3StatusMessage                string                                        `json:"s3_status_message"`
+	IcebergState                   configstore.ManagedWarehouseProvisioningState `json:"iceberg_state"`
+	IcebergStatusMessage           string                                        `json:"iceberg_status_message"`
 	IdentityState                  configstore.ManagedWarehouseProvisioningState `json:"identity_state"`
 	IdentityStatusMessage          string                                        `json:"identity_status_message"`
 	SecretsState                   configstore.ManagedWarehouseProvisioningState `json:"secrets_state"`

controlplane/admin/api_test.go

@@ -532,6 +532,25 @@ func TestPutWarehouseDisablesPgBouncerWhenSetToFalse(t *testing.T) {
 	}
 }
 
+func TestPutWarehouseEnablesIcebergWhenSetToTrue(t *testing.T) {
+	store := newFakeAPIStore()
+	seedOrgWithWarehouse(store, "analytics")
+	router := newTestAPIRouter(store)
+
+	body := []byte(`{"iceberg": {"enabled": true}}`)
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/orgs/analytics/warehouse", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d: %s", rec.Code, http.StatusOK, rec.Body.String())
+	}
+	if !store.warehouses["analytics"].Iceberg.Enabled {
+		t.Fatal("expected iceberg.enabled=true after PUT")
+	}
+}
+
 func TestPutWarehousePreservesNestedFieldsOnPartialUpdate(t *testing.T) {
 	store := newFakeAPIStore()
 	seedOrgWithWarehouse(store, "analytics")