[gateway] Validate configuration and redact secrets

[beryllw]

Purpose

Linked issue: close #3969

Adds the typed, validated and redacted Gateway configuration on top of #3963.

Brief change log

• Typed per-cluster connection, security and request-limit settings, with gateway.clusters declaring which clusters may be configured.
• User identity mode requires service credentials over client.security.protocol: sasl.
• connection.service.account / .secret become canonical; the legacy SASL keys keep last-wins precedence and warn once per cluster.
• Credentials become a Secret newtype, redacted in logs, errors and the startup dump.

Documentation

Module rustdoc only; user documentation lands with the delivery task in #3957.

[beryllw]

@fresh-borzoni @luoyuxia cc

[Copilot]

Pull request overview

This PR strengthens the Fluss Gateway’s configuration layer by adding typed per-cluster settings, cross-field validation, and consistent secret redaction in logs/errors/diagnostics, building on the gateway runtime foundation added previously.

Changes:

• Introduces typed cluster, security, metrics, and request-limit configuration parsing/validation, including cluster declaration enforcement and reserved-but-unsupported gateway.cluster.<id>.client.* overrides.
• Adds a Secret newtype and ensures sensitive values are redacted in startup diagnostics and failure paths; logs the effective redacted configuration at startup.
• Expands process/config tests for invalid configs and redaction guarantees; updates gateway CI and dependency metadata to account for the new fluss-rs workspace dependency.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
fluss-gateway/tests/process.rs	Adds process-level tests for invalid config exit codes and secret redaction behavior.
fluss-gateway/src/lifecycle.rs	Logs the effective (redacted) configuration at debug level during startup.
fluss-gateway/src/config.rs	Implements typed config loading with precedence, per-cluster config model, validation, reserved client override rejection, and secret redaction.
fluss-gateway/justfile	Normalizes dependency inventory generation to avoid trailing whitespace drift.
fluss-gateway/DEPENDENCIES.rust.tsv	Updates the checked-in dependency/license inventory after dependency graph changes.
fluss-gateway/Cargo.toml	Adds a path dependency on fluss-rs to build native client connection settings from typed config.
fluss-gateway/Cargo.lock	Updates lockfile for the new fluss-rs dependency and its transitive crates.
.github/workflows/gateway-ci.yml	Extends CI path triggers for fluss-rs/protos and ensures protoc is installed for builds/checks; updates inventory drift check.

Suppressed comments (2)

fluss-gateway/src/config.rs:962

• This error message for identity-mode: user refers to {CLUSTER_SERVICE_ACCOUNT_KEY} / {CLUSTER_SERVICE_SECRET_KEY} without the cluster prefix, so the rendered message won’t clearly point to the public config keys. Prefer printing the fully qualified keys for all referenced options.

                problems.push(format!(
                    "{} user requires {CLUSTER_SERVICE_ACCOUNT_KEY} and {CLUSTER_SERVICE_SECRET_KEY}",
                    cluster_key(id, CLUSTER_IDENTITY_MODE_KEY)
                ));

fluss-gateway/src/config.rs:1047

• This startup warning mixes a fully-qualified key with bare suffix keys (connection.idle-timeout, connection.identity-mode). Since this is operator-facing diagnostics, it should consistently print the full public keys (including the cluster prefix) for all referenced options.

                warnings.push(format!(
                    "{} and {CLUSTER_CONNECTION_IDLE_TIMEOUT_KEY} are ignored because \
                     {CLUSTER_IDENTITY_MODE_KEY} is service",
                    cluster_key(id, CLUSTER_CONNECTION_MAX_KEY)
                ));

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[fresh-borzoni]

@beryllw Thank you for the PR, left some comments , PTAL

[fresh-borzoni]

@beryllw Thank you, LGTM 👍
I'll merge once CI passes.