feat(auth): rewritten path support

[alukach]

What I'm changing

When path-mapping rewrites an incoming request (e.g. /acme/data/report.csv → /acme:data/report.csv, or stripping a prefix segment from a prefix= query param during a list), the proxy was running SigV4 verification against the rewritten path/query. Since clients sign the path they actually sent, verification fails for any request that triggers a rewrite. This change carries the original client-facing path and query through to the auth step so signature verification matches what the client signed, while operation parsing continues to use the rewritten form.

How I did it

• path-mapping: replaced the (String, Option<String>) return tuple from PathMapping::rewrite_request with a new RewriteResult { path, query, signing_path, signing_query } struct. The rewritten values feed the operation parser; the signing values preserve the original client-facing path/query for signature verification. All three rewrite branches (direct map, prefix-routed list, pass-through) populate the new fields, with tests updated and expanded to assert on both pairs.
• route_handler::RequestInfo: added optional signing_path and signing_query fields, plus with_signing_path / with_signing_query builder methods. When unset, the request's own path / query are used so existing callers that don't rewrite are unaffected.
• router: threads signing_path / signing_query from the incoming RequestInfo into the matched route's RequestInfo so rewrites set upstream survive the route match.
• proxy::resolve_request_with_metadata: refactored from a 5-parameter signature into one that takes &RequestInfo<'_>. This was a prerequisite to thread the new signing fields through cleanly without growing the parameter list further. auth::resolve_identity is now called with signing_path.unwrap_or(path) and signing_query.or(query) so verification uses the client-signed values when present.

Test plan

• cargo check — passes
• cargo check -p multistore-cf-workers --target wasm32-unknown-unknown — passes
• Existing path-mapping tests updated to cover both rewritten and signing fields across all rewrite cases

[github-actions]

🚀 Latest commit deployed to https://multistore-proxy-pr-34.development-seed.workers.dev

• Date: 2026-05-21T04:40:23Z
• Commit: 2b68ada