Merge origin/main (Hilt client + per-bucket spaces) into fil-588-blob-remove

Ports the deferred-park multipart and blob-removal flow onto main's Hilt
architecture. The load-bearing resolutions:

- Space is per-bucket and threaded as a parameter (main's model): the
  DeferredBodyUploader seams (UploadBlobParked/ConcludeBlob/AbortBlob),
  BlobRemover, and the s3frontend park/conclude/cleanup paths all take
  the bucket's space, resolved via the new Backend.bucketSpace helper
  (the session-expiry sweeper resolves it per session).
- Proof chains are request-scoped (main's model): park and upload
  require the IAM-attached reqscope store and capture it as the space's
  write authority; abort and remove resolve reqscope-first with the
  captured store as the off-request fallback (the sweeper path).
  forgeclient.BlobRemove/BlobAbort accept WithProofStore like BlobAdd.
- forgeclient.BlobAddParked/BlobConclude re-derived from main's BlobAdd:
  per-call proof store, no /blob/accept re-delegation (sprue owns
  accept), conclude carries no space proof.
- seedSpaceDelegations and standaloneApp stay deleted (main): space
  authority is Hilt-issued per access key. NOTE: hilt's s3perm map does
  not yet delegate /blob/abort — multipart abort needs a hilt follow-up.
- MultipartSessionTTL ported into config.ServerConfig; the sweeper keeps
  running under main's config package.
- Fork-era s3err constants: ErrInvalidPartNumberRange for the Complete
  part-number range check, ErrInvalidRequest for invalid list markers.
- versity partition: kept the fil-520 placements (ListParts implemented,
  Complete validation fixed) and moved main's two XFail cases
  (etag_quoting_consistency, missing_part_fields) into the passing
  lists; forge itests provision via hiltProvisionTenant.
- go.mod: libforge at the RFC-alignment pin, smelt at main's Hilt-era
  pin — the smelt fil-588 branch (/blob/release delegation) must rebase
  onto smelt main before the removal itests can run end-to-end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: frrist

CLAUDE.md

@@ -52,7 +52,10 @@ ingot depends only on these — it must **never** import `fil-forge/sprue` or
   `commands/{blob,content,http,assert,ucan,index,provider,access}`, `blobindex`
   (sharded-dag-index), `ucan` (ProofStore), `ucan/retrieval`, `didmailto`, `receipt`.
 - **`indexing-service/pkg/{client,types}`** — indexer query client.
-- **`versity/versitygw`** — the S3 REST front end (we implement `backend.Backend`).
+- **`fil-forge/versitygw`** — our fork of versity/versitygw, the S3 REST front
+  end (we implement `backend.Backend`). The fork adds externally derived SigV4
+  signing keys (`auth.Account.SigningKey`, `middlewares.RequestIAMService`) for
+  the Hilt flow.
 - Plumbing: `go-cid`, `go-block-format`, `whyrusleeping/cbor-gen` (**not**
   go-ipld-prime), `multiformats/*`, `pgx/v5`, `goose/v3`, `spf13/{cobra,viper}`,
   `uber-go/fx`, `zap`.
@@ -96,10 +99,21 @@ Internal:
 - **`forgeclient/`** — carried-from-guppy edge client: `/blob/add`,
   `/ucan/conclude`, `/index/add`, `/provider/add`, `/access/delegate`, and the
   `/access` login flow.
+- **`iam/`** — the Hilt (auth-service) integration over the external
+  `github.com/fil-forge/hilt/pkg/client` (RFC: forge-s3-tenant-management):
+  versitygw `IAMService`/`RequestIAMService` authorizing each non-root
+  request via `/s3/request/authorize` (derived SigV4 key), plus
+  `DelegationCache` — a TTL cache (go-cache) of Hilt-issued delegations
+  (authorize re-delegations + `/s3/bucket/info` chains) that the network
+  read tier consumes as its per-space `/content/retrieve` proof store.
+  **Forge mode requires Hilt** (`auth_service_url`/`auth_service_did`): the
+  postgres registry forwards bucket create/delete/list to it, recovering
+  the signed S3 request from the method's ctx.
 - **`tokenstore/`** — carried-from-guppy delegation store (`tokens.cbor`).
 - **`bucket/`** — per-object model: `manifest.go` (`ObjectManifest`, `Body`),
   `chunker.go` (`BodyCodec`/`FixedChunker`), `cbor_gen.go`.
-- **`mst/`** — the forked MST (only dep: go-cid).
+- **`mst/`** — the forked MST (deps: go-cid, blockstore, ucantone/did — trees
+  carry their bucket's space for network-backed reads).
 - **`inmem/`** — `MemStore` (Registry+Meta), `NopBaseReader`, `NopUploader`; backs
   standalone mode (slated for removal).
 - **`cars/`**, **`migrations/`**, **`internal/ucanexec/`**, **`gen/`**,
@@ -141,7 +155,9 @@ Viper/yaml-bindable. Key fields: `Enabled`, `Addr`, `DataDir`, `Region`,
 `DataPlane`/`CatalogPlane` `{SealBytes, SealAge, Ship, Retain}` overrides,
 `IndexerEndpoint`/`IndexerDID`, `ReadCacheBytes` (0 → 256 MiB, <0 → off),
 `UploadServiceURL`/`UploadServiceDID`/`UploadReceiptsURL`, `TokenStoreDir`
-(→ `DataDir`). `Config.ServerConfig()` is the single mapping site. The daemon's
+(→ `DataDir`), `HiltURL`/`HiltDID`/`HiltProofs` (tenant-management service;
+proofs = file path or string-encoded UCAN container, optional).
+`Config.ServerConfig()` is the single mapping site. The daemon's
 `DaemonConfig` (cmd/config.go) embeds `Config` + `Mode`/`PostgresDSN`/`Identity`.
 
 ## Testing

Dockerfile

@@ -24,8 +24,7 @@
 #     /usr/bin/ingot -- serve --config /etc/ingot/config.yaml
 # then attach your client on the mapped 2345 (smelt's compose.debug.yml pattern).
 
-# ---- build base: runs natively on the builder, cross-compiles to target ----
-FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
+FROM --platform=$BUILDPLATFORM golang:1.26-bookworm AS build
 ARG TARGETOS=linux
 ARG TARGETARCH
 WORKDIR /src

blockstore/cache.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"sync"
 
+	"github.com/fil-forge/ucantone/did"
 	block "github.com/ipfs/go-block-format"
 	"github.com/ipfs/go-cid"
 	mh "github.com/multiformats/go-multihash"
@@ -61,21 +62,23 @@ var (
 // Body blobs are large and streamed; caching one whole would defeat streaming
 // (and a single blob can exceed the whole budget). Small catalog blocks still
 // cache through GetBlock.
-func (c *Cached) OpenBlob(ctx context.Context, digest mh.Multihash) (io.ReadCloser, error) {
+func (c *Cached) OpenBlob(ctx context.Context, space did.DID, digest mh.Multihash) (io.ReadCloser, error) {
 	if br, ok := c.base.(BlobReader); ok {
-		return br.OpenBlob(ctx, digest)
+		return br.OpenBlob(ctx, space, digest)
 	}
 	return nil, ErrNotFound
 }
 
 // GetBlock returns the cached block if present, otherwise fetches it from the
-// base reader and caches it (subject to the byte budget).
-func (c *Cached) GetBlock(ctx context.Context, k cid.Cid) (block.Block, error) {
+// base reader and caches it (subject to the byte budget). The LRU is keyed by
+// CID only — blocks are content-addressed, so a hit is valid whatever space
+// originally fetched it.
+func (c *Cached) GetBlock(ctx context.Context, space did.DID, k cid.Cid) (block.Block, error) {
 	key := k.KeyString()
 	if blk, ok := c.get(key); ok {
 		return blk, nil
 	}
-	blk, err := c.base.GetBlock(ctx, k)
+	blk, err := c.base.GetBlock(ctx, space, k)
 	if err != nil {
 		return nil, err
 	}

blockstore/cache_test.go

@@ -2,6 +2,7 @@ package blockstore
 
 import (
 	"context"
+	"github.com/fil-forge/ucantone/did"
 	"testing"
 
 	block "github.com/ipfs/go-block-format"
@@ -18,7 +19,7 @@ type countingReader struct {
 	calls     map[string]int
 }
 
-func (r *countingReader) GetBlock(_ context.Context, c cid.Cid) (block.Block, error) {
+func (r *countingReader) GetBlock(_ context.Context, _ did.DID, c cid.Cid) (block.Block, error) {
 	if r.calls == nil {
 		r.calls = map[string]int{}
 	}
@@ -50,7 +51,7 @@ func TestCached_Hit(t *testing.T) {
 	k := mkcid(7)
 
 	for i := 0; i < 3; i++ {
-		if _, err := c.GetBlock(context.Background(), k); err != nil {
+		if _, err := c.GetBlock(context.Background(), did.Undef, k); err != nil {
 			t.Fatalf("get: %v", err)
 		}
 	}
@@ -66,20 +67,20 @@ func TestCached_EvictsByBytes(t *testing.T) {
 
 	first, second, third := mkcid(1), mkcid(2), mkcid(3)
 	for _, k := range []cid.Cid{first, second, third} {
-		if _, err := c.GetBlock(context.Background(), k); err != nil {
+		if _, err := c.GetBlock(context.Background(), did.Undef, k); err != nil {
 			t.Fatalf("get: %v", err)
 		}
 	}
 
 	// first was evicted -> refetched (2 base hits).
-	if _, err := c.GetBlock(context.Background(), first); err != nil {
+	if _, err := c.GetBlock(context.Background(), did.Undef, first); err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	if got := base.calls[first.KeyString()]; got != 2 {
 		t.Fatalf("expected first block evicted and refetched (2 base hits), got %d", got)
 	}
 	// third is the most-recently-used and still cached (1 base hit).
-	if _, err := c.GetBlock(context.Background(), third); err != nil {
+	if _, err := c.GetBlock(context.Background(), did.Undef, third); err != nil {
 		t.Fatalf("get: %v", err)
 	}
 	if got := base.calls[third.KeyString()]; got != 1 {