M1 foundation: fix proxy, pool HTTP clients, split services, add ApiError + RLS

- Fix proxy body forwarding, round-robin load balancing, response streaming
- Pool reqwest::Client in proxy, control, and gateway (no per-request alloc)
- Harden CORS in gateway/main.rs (was allow_origin(Any), now uses ALLOWED_ORIGINS)
- Add common/src/error.rs: ApiError type with structured JSON responses
- Add common/src/rls.rs: RlsTransaction extractor for deduplicated RLS setup
- Fix tracing in all standalone binaries (EnvFilter instead of unused var)
- Dockerfile multi-stage: separate worker-runtime, control-runtime, proxy-runtime targets
- docker-compose.yml: split into worker/system/proxy services with health checks
- Fix Grafana port mapping in pillar-system (3030:3000)
- Add config/prometheus.yml and config/vmagent.yml
- Add .env.example with all required variables
- 55 tests pass (49 run + 6 ignored integration tests requiring external services)

Made-with: Cursor

control-plane-api/src/lib.rs

@@ -25,6 +25,28 @@ pub struct AppState {
     server_manager: Arc<ServerManager>,
 }
 
+async fn api_key_middleware(
+    req: axum::extract::Request,
+    next: axum::middleware::Next,
+) -> Result<axum::response::Response, StatusCode> {
+    let path = req.uri().path();
+    if path == "/health" || path.ends_with("/health") {
+        return Ok(next.run(req).await);
+    }
+
+    let expected = std::env::var("CONTROL_PLANE_API_KEY")
+        .expect("CONTROL_PLANE_API_KEY must be set");
+
+    let provided = req.headers()
+        .get("x-api-key")
+        .and_then(|v| v.to_str().ok());
+
+    match provided {
+        Some(key) if key == expected => Ok(next.run(req).await),
+        _ => Err(StatusCode::UNAUTHORIZED),
+    }
+}
+
 pub async fn init(db: PgPool, ssh_key: String) -> Router {
     // Load provider config from environment
     let provider_config = crate::providers::factory::ProviderConfig::from_env();
@@ -61,6 +83,7 @@ pub async fn init(db: PgPool, ssh_key: String) -> Router {
         .route("/api/v1/cluster/health", get(cluster_health))
         .route("/api/v1/cluster/pillars", get(list_pillars))
         
+        .layer(axum::middleware::from_fn(api_key_middleware))
         .with_state(state)
 }