Implement admission, credential expiry and access revocation #977

Parent: #970

Deliverable

A transport-independent admission component that binds each accepted request to one authorized connector and gVPC and terminates forwarding when authority expires.

Dependencies

#972, #976, foundation #994; coordinate pre-admission limits and negative cases with #991.

Galactic Edge integration (#992)

Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.

Work

• Implement the selected credential profile and trust configuration, resolving an authenticated principal to explicit connector/gVPC grants.
• Bind immutable authorization context to each CONNECT-IP request; reject missing, invalid, expired, ambiguous or unauthorized credentials and references.
• Consume revocation and authorization updates through the accepted internal interface and cap forwarding validity by credential, grant and ownership deadlines.
• Provide an internal test/configuration path to exercise enrollment-independent credentials and grants. Do not add a public API, client login workflow or plugin/portal integration.

Acceptance criteria

• Unit and integration tests cover valid admission, wrong issuer/audience where applicable, expiry, revoked access and attempts to select another gVPC.
• Existing forwarding stops within the agreed bound after expiry or revocation, including the documented control-plane outage case.
• Authorization cannot be extended merely by reconnecting or replaying stale grant state.
• The component exposes the same decision and immutable context to HTTP/3 and HTTP/2 adapters; credentials are absent from logs.

Additional integration acceptance

• Authenticate external clients separately from pod-bound provider authentication. Resolve trusted connector grants to a foundation-authorized EdgeService/VPC/prefix; client input cannot create or broaden provider grants.
• Bind credential/grant version and deadline to immutable VPC/service/attachment/route/session identities. Fail closed on deleted/recreated grants, stale versions and ambiguous mappings.
• Implement the per-connector authority model agreed in Define connector admission, addressing and ownership contracts #972/Integrate connector ownership with Edge claims and independent expiry #976 and test single-connector revocation while other connectors renew the same instance, including stale reconnect attempts and authority-source outage.
• Complete authentication and authorization before any MTU probe or tenant packet I/O; test CONNECT-IP server lacks overload limits and tenant isolation checks #991's unauthenticated probe case on both transports.

Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.