feat(iam): persist STS temp credential secrets for later lookup

[vieiralucas]

Summary

Batch 2 of 9 for the opt-in SigV4 verification + IAM enforcement work. Makes STS temporary credentials persistable and round-trippable so later batches can look them up by access key ID.

Previously:

• AssumeRole / AssumeRoleWithWebIdentity / AssumeRoleWithSAML stored only the access key ID in credential_identities, discarding the secret and session token.
• GetSessionToken / GetFederationToken returned hardcoded AQoEXAMPLEH4 / FSIAIOSFODNN7EXAMPLE constants that were not persisted.

Now:

• New StsTempCredential struct + sts_temp_credentials: HashMap<String, StsTempCredential> field on IamState, carrying secret access key, session token, principal ARN, user id, account id, and absolute expiration.
• New IamState::credential_secret / credential_secret_readonly helpers that resolve AKID → SecretLookup {secret, session_token, principal_arn, user_id, account_id}. Expired STS temp credentials are lazy-purged on the mutable variant.
• All five STS operations persist the full generated credential and return it in the XML response (the hardcoded xml_responses constants are gone).
• account_id is sourced from the credential itself (not from global config), so Feature proposal: multi-account isolation within a single fakecloud instance #381 (multi-account isolation) becomes a state-partitioning change rather than a cross-cutting rewrite.

Why this batch comes before SigV4 verification

Batch 3 adds verify_sigv4, which needs to look up the secret access key for any AKID in circulation — including STS temporary credentials. If the STS table doesn't store the secret, any SDK that calls AssumeRole and then uses the returned credentials would fail verification. This batch fixes that gap first.

Decisions

• GetSessionToken now resolves the caller via credential_secret and scopes the new temporary credential to that principal (falling back to account root when the caller isn't a known IAM user — matches AWS behavior with root creds).
• GetFederationToken resolves the federated-user ARN from the Name parameter as before, but now persists a real per-request credential tied to that ARN.
• Hardcoded constants in xml_responses::{get_session_token_response, get_federation_token_response} are removed. They were compatible in isolation but are incompatible with per-request verification.
• Two existing E2E tests (sts_get_session_token / sts_get_federation_token) previously asserted on the hardcoded token prefix AQoEXAMPLEH4; updated to the per-request FQoGZXIvYXdzE format and extended to assert two calls return distinct credentials.

Test plan

• cargo test -p fakecloud-iam — 78 tests including 5 new state::tests::credential_secret_* cases
• cargo test -p fakecloud-e2e --test iam sts_ — 11 STS e2e tests, including a new sts_assume_role_temp_credentials_resolve_via_get_caller_identity that round-trips AssumeRole → GetCallerIdentity with the temporary credentials and verifies the assumed-role ARN
• cargo test -p fakecloud-conformance — 711+ tests, all green (zero regressions)
• cargo clippy --workspace --all-targets -- -D warnings clean
• cargo fmt --check clean

---

Summary by cubic

Persists STS temporary credential secrets and session tokens so we can look them up by access key ID for upcoming SigV4 verification and IAM enforcement. All STS APIs now return and persist per-request credentials instead of static examples.

• New Features - New features added
  • Added StsTempCredential and sts_temp_credentials on IamState with absolute expiration.
  • Added IamState::credential_secret and credential_secret_readonly to resolve AKID → {secret, session token, principal ARN, user id, account id}, with lazy purge of expired entries.
  • Updated AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithSAML, GetSessionToken, and GetFederationToken to store full credentials and use them in XML responses.
  • GetSessionToken now scopes creds to the caller (falls back to account root); GetFederationToken ties creds to the federated-user ARN.
  • Account ID is sourced from the credential (prep for multi-account isolation, see Feature proposal: multi-account isolation within a single fakecloud instance #381).

^{Written for commit ec0efd1. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 4 files