refactor(api): move resource initialization into api crate

[poroh]

Reduce the scope and growth of carbide-api-core by moving process initialization into the carbide-api composition crate. This PR moves database, Vault, credential, certificate, KMS, and secret-import setup without intended functional or configuration changes.

This is the third change in a planned series:

1. Move logging initialization and the top-level run entry point - refactor(api): move logging initialization into api crate #3851.
2. Move metrics initialization, the metrics endpoint, and process task ownership - refactor(api): move metrics initialization into api crate #3860.
3. Move database, Vault, credentials, certificates, KMS, and secret-import setup - this PR.
4. Move dynamic settings, IPMI, Redfish, RMS, InfiniBand, NMX-C, DPF, and component-manager client setup.

The existing credential routing, certificate configuration, KMS validation, Vault import behavior, and database pool configuration are preserved. Dependencies no longer used by api-core move with the implementation.

Related issues

#3851
#3860

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

This PR is stacked on #3860 and should merge after it.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5a7dc8a3-7f64-4e90-af94-bddc5436f7f1

📥 Commits

Reviewing files that changed from the base of the PR and between bfc9e57 and ecdafd9.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• crates/api-core/Cargo.toml
• crates/api-core/src/bootstrap.rs
• crates/api-core/src/run.rs
• crates/api-core/src/setup.rs
• crates/api/Cargo.toml
• crates/api/src/lib.rs
• crates/api/src/resources.rs
• crates/api/src/run.rs

💤 Files with no reviewable changes (1)

• crates/api-core/Cargo.toml

🚧 Files skipped from review as they are similar to previous changes (6)

• crates/api-core/src/bootstrap.rs
• crates/api/Cargo.toml
• crates/api/src/run.rs
• crates/api-core/src/run.rs
• crates/api-core/src/setup.rs
• crates/api/src/resources.rs

---

Summary by CodeRabbit

• New Features

  • Added automatic runtime resource setup for database, certificate, credential, and secrets services.
  • Added configurable IPMI tool selection (test, proxy-based mock, or /usr/bin/ipmitool).
  • Implemented coordinated one-time Vault secret import during startup.

• Improvements

  • Streamlined API startup by injecting pre-built runtime dependencies instead of constructing them internally.
  • Updated logging/tracing setup to refine runtime log filtering and time formatting.

Walkthrough

Runtime resource initialization moved from api-core into the API crate. The API now builds database, credential, certificate, KMS, and Vault-import resources, then passes them into run_core through CoreRunInputs.

Changes

Runtime resource initialization

Layer / File(s)	Summary
Resource assembly and database setup crates/api/src/resources.rs, crates/api/src/lib.rs	Adds RuntimeResources and setup_resources, including Vault, certificate, Postgres, and local credential setup with database duration validation and tests.
KMS routing and Vault import crates/api/src/resources.rs, crates/api-core/src/bootstrap.rs	Adds routed KMS construction and session-locked, one-time Vault-to-Postgres import handling with completion checks.
Injected core startup dependencies crates/api/src/run.rs, crates/api-core/src/run.rs, crates/api-core/src/setup.rs, crates/api-core/Cargo.toml, crates/api/Cargo.toml	Passes assembled resources into run_core, removes duplicated api-core initialization, exposes IPMI tool selection, and adjusts crate dependencies.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant API
  participant setup_resources
  participant Postgres
  participant run_core
  API->>setup_resources: initialize runtime resources
  setup_resources->>Postgres: connect and optionally import Vault secrets
  setup_resources->>API: return RuntimeResources
  API->>run_core: pass credential, certificate, database, and secrets resources

Loading

Possibly related PRs

• NVIDIA/infra-controller#3851: Continues the refactor that moves initialization out of api-core and reshapes CoreRunInputs.
• NVIDIA/infra-controller#3860: Related CoreRunInputs and run_core input-wiring changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main refactor: moving resource initialization into the api crate.
Description check	✅ Passed	The description is clearly related to the changeset and matches the refactor scope described in the summaries.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}