M1 foundation: fix proxy, pool HTTP clients, split services, add ApiError + RLS

- Fix proxy body forwarding, round-robin load balancing, response streaming
- Pool reqwest::Client in proxy, control, and gateway (no per-request alloc)
- Harden CORS in gateway/main.rs (was allow_origin(Any), now uses ALLOWED_ORIGINS)
- Add common/src/error.rs: ApiError type with structured JSON responses
- Add common/src/rls.rs: RlsTransaction extractor for deduplicated RLS setup
- Fix tracing in all standalone binaries (EnvFilter instead of unused var)
- Dockerfile multi-stage: separate worker-runtime, control-runtime, proxy-runtime targets
- docker-compose.yml: split into worker/system/proxy services with health checks
- Fix Grafana port mapping in pillar-system (3030:3000)
- Add config/prometheus.yml and config/vmagent.yml
- Add .env.example with all required variables
- 55 tests pass (49 run + 6 ignored integration tests requiring external services)

Made-with: Cursor

storage/Cargo.toml

@@ -17,6 +17,7 @@ aws-sdk-s3 = { workspace = true }
 aws-config = { workspace = true }
 aws-types = { workspace = true }
 
+async-trait = "0.1"
 bytes = "1.0"
 anyhow = { workspace = true }
 tower = "0.4"

storage/src/backend.rs

@@ -160,4 +160,15 @@ mod tests {
         assert!(get_result.is_ok());
         assert_eq!(get_result.unwrap(), test_data);
     }
+
+    #[test]
+    #[should_panic(expected = "S3_ACCESS_KEY or MINIO_ROOT_USER must be set")]
+    fn test_s3_credentials_required() {
+        // Remove all S3 credential env vars
+        std::env::remove_var("S3_ACCESS_KEY");
+        std::env::remove_var("MINIO_ROOT_USER");
+        let _ = std::env::var("S3_ACCESS_KEY")
+            .or_else(|_| std::env::var("MINIO_ROOT_USER"))
+            .expect("S3_ACCESS_KEY or MINIO_ROOT_USER must be set");
+    }
 }

storage/src/lib.rs

@@ -1,3 +1,4 @@
+pub mod backend;
 pub mod handlers;
 pub mod tus;