M1 foundation: fix proxy, pool HTTP clients, split services, add ApiError + RLS

- Fix proxy body forwarding, round-robin load balancing, response streaming
- Pool reqwest::Client in proxy, control, and gateway (no per-request alloc)
- Harden CORS in gateway/main.rs (was allow_origin(Any), now uses ALLOWED_ORIGINS)
- Add common/src/error.rs: ApiError type with structured JSON responses
- Add common/src/rls.rs: RlsTransaction extractor for deduplicated RLS setup
- Fix tracing in all standalone binaries (EnvFilter instead of unused var)
- Dockerfile multi-stage: separate worker-runtime, control-runtime, proxy-runtime targets
- docker-compose.yml: split into worker/system/proxy services with health checks
- Fix Grafana port mapping in pillar-system (3030:3000)
- Add config/prometheus.yml and config/vmagent.yml
- Add .env.example with all required variables
- 55 tests pass (49 run + 6 ignored integration tests requiring external services)

Made-with: Cursor

control_plane/src/lib.rs

@@ -1,7 +1,7 @@
 use axum::{
     extract::{Path, State},
     http::StatusCode,
-    routing::{delete, get, put},
+    routing::{delete, get},
     Json, Router,
 };
 use jsonwebtoken::{encode, EncodingKey, Header};
@@ -125,6 +125,30 @@ pub async fn delete_project(
     Ok(StatusCode::NO_CONTENT)
 }
 
+#[derive(Debug, Serialize, sqlx::FromRow)]
+pub struct ProjectKeys {
+    pub id: Uuid,
+    pub jwt_secret: String,
+    pub anon_key: Option<String>,
+    pub service_role_key: Option<String>,
+}
+
+pub async fn get_project_keys(
+    State(state): State<ControlPlaneState>,
+    Path(id): Path<Uuid>,
+) -> Result<Json<ProjectKeys>, (StatusCode, String)> {
+    let keys = sqlx::query_as::<_, ProjectKeys>(
+        "SELECT id, jwt_secret, anon_key, service_role_key FROM projects WHERE id = $1"
+    )
+    .bind(id)
+    .fetch_optional(&state.db)
+    .await
+    .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
+    .ok_or((StatusCode::NOT_FOUND, "Project not found".to_string()))?;
+
+    Ok(Json(keys))
+}
+
 #[derive(Deserialize)]
 pub struct RotateKeyRequest {
     pub new_secret: Option<String>,
@@ -227,7 +251,7 @@ pub fn router(state: ControlPlaneState) -> Router {
     Router::new()
         .route("/projects", get(list_projects).post(create_project))
         .route("/projects/:id", delete(delete_project))
-        .route("/projects/:id/keys", put(rotate_keys))
+        .route("/projects/:id/keys", get(get_project_keys).put(rotate_keys))
         .route("/users", get(list_users))
         .route("/users/:id", delete(delete_user))
         .with_state(state)
@@ -259,4 +283,22 @@ mod tests {
         assert_eq!(token_data.claims.sub, "anon");
         assert_eq!(token_data.claims.iss, "madbase");
     }
+
+    #[test]
+    fn test_list_projects_hides_secrets() {
+        // Verify ProjectSummary does not contain secret fields
+        let summary = ProjectSummary {
+            id: Uuid::new_v4(),
+            name: "test".to_string(),
+            status: "active".to_string(),
+            created_at: Some(chrono::Utc::now()),
+        };
+        let json = serde_json::to_value(&summary).unwrap();
+        assert!(json.get("id").is_some());
+        assert!(json.get("name").is_some());
+        assert!(json.get("jwt_secret").is_none());
+        assert!(json.get("db_url").is_none());
+        assert!(json.get("anon_key").is_none());
+        assert!(json.get("service_role_key").is_none());
+    }
 }