feat(spiffe): GET /v1/spiffe-bundle (Trust Domain Format)

[kanywst]

Summary

Adds the SPIFFE Trust Domain Format (TDF) bundle endpoint defined in SPIFFE Trust Domain and Bundle 1.0 §4. One JSON document carries both the X.509-SVID trust anchors (use: x509-svid, full DER in x5c) and the JWT-SVID public keys (use: jwt-svid) in a single JWK set, plus the spiffe_sequence and spiffe_refresh_hint envelope fields. SPIFFE-native consumers replace the pair of /v1/bundle (PEM) + /v1/jwt/bundle (JWKS) with one fetch.

The legacy endpoints stay so the existing federation pump and go-spiffe consumers do not need to change.

Example response on a fresh server:

{
  "keys": [
    {"crv":"P-256","kty":"EC","use":"x509-svid","x":"...","x5c":["MIIBdT..."],"y":"..."},
    {"alg":"ES256","crv":"P-256","kid":"BA0vwLDU7Bs","kty":"EC","use":"jwt-svid","x":"...","y":"..."}
  ],
  "spiffe_refresh_hint": 300,
  "spiffe_sequence": 1
}

Scope layer

Core. SPIFFE spec endpoint, no new dependencies. Assembly lives in identity.BuildSPIFFEBundle, a free function that reads the existing Authority.BundlePEM() + Authority.JWTBundle() accessors so the Vault PKI backend and any future Authority backend (step-ca, AWS PCA, GCP CAS) work without code changes.

Behaviour notes

• spiffe_sequence is fixed at 1 until runtime key rotation lands. omega does not rotate roots without a restart today, so the bundle is monotonic-at-one for the lifetime of a server process. The conformance row tracks this (§6 deferred → partial).
• spiffe_refresh_hint is configurable via the new --spiffe-bundle-refresh-hint flag (default 5m).
• Both EC (P-256/P-384/P-521) and RSA trust anchors are supported on the X.509 side. Unsupported key types surface a clear error rather than being silently dropped, so peers either get a full picture or a clear failure.

Test plan

• go test -race -count=1 ./internal/server/identity/ ./internal/server/api/ — passes
• New tests: TestBuildSPIFFEBundleEmitsTDFShape, TestBuildSPIFFEBundleSurfacesMalformedTrustAnchor, TestBuildSPIFFEBundleRefreshHintClampsNegative, TestSPIFFEBundleReturnsTDFDocument
• go vet ./... clean
• redocly lint api/openapi.yaml — 0 error(s)
• markdownlint-cli2 CHANGELOG.md docs/conformance-spiffe.md — 0 error(s)
• Local smoke test: omega server → curl /v1/spiffe-bundle returns the document above

Conformance moves

• docs/conformance-spiffe.md §4.1: partial → implemented
• docs/conformance-spiffe.md §6: deferred → partial (sequence becomes "implemented" once key rotation lands)

Follow-ups

• Monotonic spiffe_sequence lands with runtime key rotation.
• Federation pump could switch from /v1/bundle PEM polling to /v1/spiffe-bundle to honour spiffe_refresh_hint natively (out of scope here).