feat: nested proxy: config, gateway hardening, and end-to-end smoke tests

[insomnius]

Summary

• New nested proxy: block in app.yml consolidates host + adds two production-stability knobs (upstream_timeout, max_request_body_size). Backwards compatible with the legacy top-level proxy_host:.
• Three real production-stability fixes in the gateway proxy: per-request timeout, request body cap, response body streamed via io.Copy (no more proportional heap spike).
• End-to-end smoke test suite — 10 subtests driving the actual altair binary against MySQL + a mock upstream — wired into a new smoke CI job in general.yml.
• Drop dead core/migrator.go + core/provider.go (plugin registry refactor superseded them; zero callers remained).
• Fix the broken env.sample that crash-looped the docker-compose MySQL container (MYSQL_USER=root is rejected by MySQL 5.7).

What's new in app.yml

proxy:
  host: www.local.host         # was top-level proxy_host (still honored as deprecated alias)
  upstream_timeout: 30s        # NEW — bound the entire upstream round-trip
  max_request_body_size: 10MB  # NEW — opt-in cap, returns 413 before dialing upstream

If both proxy.host and proxy_host: are set, the nested form wins so operators can stage migrations without an outage.

Why each gateway change

Issue	Old behaviour	New behaviour
Hung upstream	http.Client{} per request, no timeout — leaked goroutines and FDs forever	Shared *http.Client with Timeout = proxy.upstream_timeout (default 30s)
Oversized client body	Unbounded io.ReadAll of c.Request.Body; ~500MB heap on a 500MB POST	http.MaxBytesReader with typed *http.MaxBytesError → 413 before dialing upstream
Response body	io.ReadAll(proxyRes.Body) then Writer.Write — full body in heap	io.Copy(c.Writer, proxyRes.Body) — streamed
Proxy host	Re-read os.Getenv("PROXY_HOST") every request	Captured once at NewGenerator from appConfig.ProxyHost()

Smoke test matrix

10 subtests, ~8s wall time. Each spawns its own altair subprocess with a per-test config (WithUpstreamTimeout(300ms) for the timeout test, WithMaxRequestBodySize(16B) for the cap test, etc.) so behaviours don't have to share an instance.

Phase A — gateway only (no MySQL):

• T1 forwarding_unauthed — method/path/X-Request-Id arrive at upstream
• T2' proxy_host_injected — proxy.host arrives as upstream Host header
• T3' body_size_cap_rejects — 413 before upstream is dialed
• T4' upstream_timeout_fires — 502 within ~300ms against a 3s-sleeping upstream
• T5' no_body_cap_default — 4KB POST round-trips when cap=0

Phase B — oauth + MySQL:

• T2 oauth_happy_path — issued bearer + matching scope reaches upstream
• T3 oauth_missing_token — 4xx, no upstream contact
• T4 oauth_invalid_token — 4xx
• T5 oauth_wrong_scope — 4xx
• T6 oauth_body_and_headers — POST round-trips body + custom header

CI

New smoke job in .github/workflows/general.yml with services: mysql:5.7. needs: verify so we don't burn CI minutes on broken PRs. Build-tagged via //go:build e2e, so make test (the unit suite + Coveralls path) is unchanged.

Test plan

• CI verify green
• CI lint green
• CI test (Coveralls) green
• CI smoke green — proves binary scaffolds, boots, forwards, rejects oversized bodies, fires timeouts, issues + validates oauth tokens
• CI govulncheck / codeql / trivy green
• Manual: cp env.sample .env && docker compose --env-file .env up -d then make smoke → 10 PASS

🤖 Generated with Claude Code