Remove mobile-config from ingest

[bbalser]

Ingest was the last production service calling the mobile-config gRPC service, which we are close to shutting down.

The only call it made was a single verify_authorized_key(pubkey, NetworkKeyRole::MobileCarrier) gate. mobile-config served those keys from an admin-registered registered_keys table — effectively static config — so ingest now reads the same allow-list straight from its settings, mirroring what #1228 did for mobile-verifier and the routing_keys allow-list mobile-packet-verifier already uses.

The gate covers the four carrier-signed endpoints:

Endpoint
submit_hex_usage_stats_report
submit_radio_usage_stats_report
submit_radio_usage_stats_report_v2
submit_enabled_carriers_info

Since that was the only usage, the mobile-config crate dependency is dropped entirely. helium-proto still supplies the NetworkKeyRole enum. verify_known_carrier_key is now synchronous — no gRPC round trip and no TTL cache on the hot path.

New ingest::authorization module matches mobile_verifier::authorization: AuthorizedKeys holding the carrier key set, a trait so tests can mock, and a role match that authorizes only MobileCarrier.

Settings

• remove config_client
• add carrier_authorized_keys — comma-separated b58 keys

Required in mobile mode and ignored in chain mode. An empty or missing list errors on boot rather than silently rejecting every carrier report, same rule as mobile-verifier's banning_authorized_keys and mobile-packet-verifier's routing_keys.

Deploy note

The key list has to come out of mobile-config while it is still up:

mobile-config-cli authorization list-keys --key-role carrier

Copy the registered_keys from that output into carrier_authorized_keys and drop the [config_client] block.

Worth flagging: registered_keys was admin-mutable at runtime, so adding a carrier key was a CLI call. It is now a settings change plus a restart. Same tradeoff the verifiers already took, but ingest is the front door for carrier submissions, so a key rotation costs more here.

Testing

cargo nextest run -p ingest — 17/17 pass. cargo clippy --workspace --all-targets and cargo fmt --check clean.

Added carrier_endpoints_reject_unauthorized_keys, which boots the server with a real empty AuthorizedKeys and asserts all four gated endpoints reject. That needed a setup_mobile_with_verifier variant in the test harness; setup_mobile() delegates to it with the existing permissive mock, so the other tests are untouched.

Remaining mobile-config references

mobile_config_cli and the CI/ECR image build. The server also still exposes Gateway, Entity, SubDao, and Admin, which have no in-repo callers — any remaining consumers of those are external and would not show up in this repo.