feat: add Hilt client and wire with FX (#35)

I [forked the versity gateway](https://github.com/fil-forge/versitygw) to add support for externally derived SigV4 signing keys, since Ingot never sees the secret key when it uses Hilt.

This PR uses the fork, and adds an IAM service that calls Hilt to authorize requests, and authroizes locally with cached keys/delegations if possible.

There's a bunch of churn here due to the imports being re-written to our fork, but also because the versitygw Ingot depends on was not the most recent version. I also moved `hiltclient` into a `hilt` package that now houses both `client` and `iam` sub-packages - sorry.

I'm interested in whether the versity gateway change seems like a reasonable PR we could submit upstream?

Depends on:

* fil-forge/versitygw#1
* #35
* fil-forge/piri#32

Author: alanshaw

CLAUDE.md

@@ -52,7 +52,10 @@ ingot depends only on these — it must **never** import `fil-forge/sprue` or
   `commands/{blob,content,http,assert,ucan,index,provider,access}`, `blobindex`
   (sharded-dag-index), `ucan` (ProofStore), `ucan/retrieval`, `didmailto`, `receipt`.
 - **`indexing-service/pkg/{client,types}`** — indexer query client.
-- **`versity/versitygw`** — the S3 REST front end (we implement `backend.Backend`).
+- **`fil-forge/versitygw`** — our fork of versity/versitygw, the S3 REST front
+  end (we implement `backend.Backend`). The fork adds externally derived SigV4
+  signing keys (`auth.Account.SigningKey`, `middlewares.RequestIAMService`) for
+  the Hilt flow.
 - Plumbing: `go-cid`, `go-block-format`, `whyrusleeping/cbor-gen` (**not**
   go-ipld-prime), `multiformats/*`, `pgx/v5`, `goose/v3`, `spf13/{cobra,viper}`,
   `uber-go/fx`, `zap`.
@@ -96,10 +99,21 @@ Internal:
 - **`forgeclient/`** — carried-from-guppy edge client: `/blob/add`,
   `/ucan/conclude`, `/index/add`, `/provider/add`, `/access/delegate`, and the
   `/access` login flow.
+- **`iam/`** — the Hilt (auth-service) integration over the external
+  `github.com/fil-forge/hilt/pkg/client` (RFC: forge-s3-tenant-management):
+  versitygw `IAMService`/`RequestIAMService` authorizing each non-root
+  request via `/s3/request/authorize` (derived SigV4 key), plus
+  `DelegationCache` — a TTL cache (go-cache) of Hilt-issued delegations
+  (authorize re-delegations + `/s3/bucket/info` chains) that the network
+  read tier consumes as its per-space `/content/retrieve` proof store.
+  **Forge mode requires Hilt** (`auth_service_url`/`auth_service_did`): the
+  postgres registry forwards bucket create/delete/list to it, recovering
+  the signed S3 request from the method's ctx.
 - **`tokenstore/`** — carried-from-guppy delegation store (`tokens.cbor`).
 - **`bucket/`** — per-object model: `manifest.go` (`ObjectManifest`, `Body`),
   `chunker.go` (`BodyCodec`/`FixedChunker`), `cbor_gen.go`.
-- **`mst/`** — the forked MST (only dep: go-cid).
+- **`mst/`** — the forked MST (deps: go-cid, blockstore, ucantone/did — trees
+  carry their bucket's space for network-backed reads).
 - **`inmem/`** — `MemStore` (Registry+Meta), `NopBaseReader`, `NopUploader`; backs
   standalone mode (slated for removal).
 - **`cars/`**, **`migrations/`**, **`internal/ucanexec/`**, **`gen/`**,
@@ -141,7 +155,9 @@ Viper/yaml-bindable. Key fields: `Enabled`, `Addr`, `DataDir`, `Region`,
 `DataPlane`/`CatalogPlane` `{SealBytes, SealAge, Ship, Retain}` overrides,
 `IndexerEndpoint`/`IndexerDID`, `ReadCacheBytes` (0 → 256 MiB, <0 → off),
 `UploadServiceURL`/`UploadServiceDID`/`UploadReceiptsURL`, `TokenStoreDir`
-(→ `DataDir`). `Config.ServerConfig()` is the single mapping site. The daemon's
+(→ `DataDir`), `HiltURL`/`HiltDID`/`HiltProofs` (tenant-management service;
+proofs = file path or string-encoded UCAN container, optional).
+`Config.ServerConfig()` is the single mapping site. The daemon's
 `DaemonConfig` (cmd/config.go) embeds `Config` + `Mode`/`PostgresDSN`/`Identity`.
 
 ## Testing

Dockerfile

@@ -24,8 +24,7 @@
 #     /usr/bin/ingot -- serve --config /etc/ingot/config.yaml
 # then attach your client on the mapped 2345 (smelt's compose.debug.yml pattern).
 
-# ---- build base: runs natively on the builder, cross-compiles to target ----
-FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
+FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS build
 ARG TARGETOS=linux
 ARG TARGETARCH
 WORKDIR /src

blockstore/cache.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"sync"
 
+	"github.com/fil-forge/ucantone/did"
 	block "github.com/ipfs/go-block-format"
 	"github.com/ipfs/go-cid"
 	mh "github.com/multiformats/go-multihash"
@@ -61,21 +62,23 @@ var (
 // Body blobs are large and streamed; caching one whole would defeat streaming
 // (and a single blob can exceed the whole budget). Small catalog blocks still
 // cache through GetBlock.
-func (c *Cached) OpenBlob(ctx context.Context, digest mh.Multihash) (io.ReadCloser, error) {
+func (c *Cached) OpenBlob(ctx context.Context, space did.DID, digest mh.Multihash) (io.ReadCloser, error) {
 	if br, ok := c.base.(BlobReader); ok {
-		return br.OpenBlob(ctx, digest)
+		return br.OpenBlob(ctx, space, digest)
 	}
 	return nil, ErrNotFound
 }
 
 // GetBlock returns the cached block if present, otherwise fetches it from the
-// base reader and caches it (subject to the byte budget).
-func (c *Cached) GetBlock(ctx context.Context, k cid.Cid) (block.Block, error) {
+// base reader and caches it (subject to the byte budget). The LRU is keyed by
+// CID only — blocks are content-addressed, so a hit is valid whatever space
+// originally fetched it.
+func (c *Cached) GetBlock(ctx context.Context, space did.DID, k cid.Cid) (block.Block, error) {
 	key := k.KeyString()
 	if blk, ok := c.get(key); ok {
 		return blk, nil
 	}
-	blk, err := c.base.GetBlock(ctx, k)
+	blk, err := c.base.GetBlock(ctx, space, k)
 	if err != nil {
 		return nil, err
 	}

blockstore/cache_test.go

@@ -2,6 +2,7 @@ package blockstore
 
 import (
 	"context"
+	"github.com/fil-forge/ucantone/did"
 	"testing"
 
 	block "github.com/ipfs/go-block-format"
@@ -18,7 +19,7 @@ type countingReader struct {
 	calls     map[string]int
 }
 
-func (r *countingReader) GetBlock(_ context.Context, c cid.Cid) (block.Block, error) {
+func (r *countingReader) GetBlock(_ context.Context, _ did.DID, c cid.Cid) (block.Block, error) {
 	if r.calls == nil {
 		r.calls = map[string]int{}
 	}
@@ -50,7 +51,7 @@ func TestCached_Hit(t *testing.T) {
 	k := mkcid(7)
 
 	for i := 0; i < 3; i++ {
-		if _, err := c.GetBlock(context.Background(), k); err != nil {
+		if _, err := c.GetBlock(context.Background(), did.Undef, k); err != nil {
 			t.Fatalf("get: %v", err)
 		}
 	}
@@ -66,20 +67,20 @@ func TestCached_EvictsByBytes(t *testing.T) {
 
 	first, second, third := mkcid(1), mkcid(2), mkcid(3)
 	for _, k := range []cid.Cid{first, second, third} {
-		if _, err := c.GetBlock(context.Background(), k); err != nil {
+		if _, err := c.GetBlock(context.Background(), did.Undef, k); err != nil {
 			t.Fatalf("get: %v", err)
 		}
 	}
 
 	// first was evicted -> refetched (2 base hits).
-	if _, err := c.GetBlock(context.Background(), first); err != nil {
+	if _, err := c.GetBlock(context.Background(), did.Undef, first); err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	if got := base.calls[first.KeyString()]; got != 2 {
 		t.Fatalf("expected first block evicted and refetched (2 base hits), got %d", got)
 	}
 	// third is the most-recently-used and still cached (1 base hit).
-	if _, err := c.GetBlock(context.Background(), third); err != nil {
+	if _, err := c.GetBlock(context.Background(), did.Undef, third); err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	if got := base.calls[third.KeyString()]; got != 1 {