Add 9 Lambda Layer operations: PublishLayerVersion, GetLayerVersion,
GetLayerVersionByArn, ListLayerVersions, ListLayers, DeleteLayerVersion,
AddLayerVersionPermission, GetLayerVersionPolicy, RemoveLayerVersionPermission.

Introduces LayerStore with DashMap-backed concurrent storage, LayerRecord
and LayerVersionRecord types, layer ARN generation/parsing helpers, and
resource-based policy support per layer version. Includes 20 new unit tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add 5 Lambda Event Source Mapping operations: CreateEventSourceMapping,
GetEventSourceMapping, UpdateEventSourceMapping, DeleteEventSourceMapping,
ListEventSourceMappings.

Introduces EventSourceMappingStore with DashMap-backed concurrent storage,
EventSourceMappingRecord for mapping state, UUID-based identification,
filtering by function name and event source ARN, and marker-based
pagination. Includes 22 new unit tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add 10 IAM operations: CreateOpenIDConnectProvider, GetOpenIDConnectProvider,
DeleteOpenIDConnectProvider, ListOpenIDConnectProviders, TagPolicy,
UntagPolicy, ListPolicyTags, TagInstanceProfile, UntagInstanceProfile,
ListInstanceProfileTags.

Introduces OidcProviderRecord type and oidc_providers DashMap in IamStore.
OIDC provider ARNs use normalized URL (host+path). Policy and instance
profile tagging reuse existing tag merge/validate patterns with 50-tag limit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… endpoint operations (Phase 5)

Replace 26 EventBridge Phase 3 operation stubs with real CRUD
implementations: Archives (5), Replays (4), API Destinations (5),
Connections (6), Endpoints (5).

Uses DashMap<String, serde_json::Value> storage per resource type with
generic CRUD helpers for create/describe/update/delete/list patterns.
Each resource gets proper ARN generation, state management, and timestamps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

DynamoDB: Add DescribeLimits (hardcoded 80000/40000 capacity units) and
DescribeEndpoints (returns regional endpoint with 1440-min cache).

Lambda: Add 8 operations for concurrency and event invoke configuration:
PutFunctionConcurrency, GetFunctionConcurrency, DeleteFunctionConcurrency,
PutFunctionEventInvokeConfig, GetFunctionEventInvokeConfig,
UpdateFunctionEventInvokeConfig, DeleteFunctionEventInvokeConfig,
ListFunctionEventInvokeConfigs.

Concurrency stored as optional i32 on FunctionRecord. Event invoke configs
stored per qualifier with max retry attempts (0-2), max event age
(60-21600s), and destination config (on_success/on_failure ARNs).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Revert cargo nightly fmt changes to ruststack-auth that corrupted \n
escape sequences in string literals, breaking SigV4 signature computation
and 6 tests.

Fix TOCTOU in handle_tag_resource: tags were mutated before count
validation, persisting over-limit tags on error. Now clones, merges,
validates, then commits atomically.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Run cargo +nightly fmt across auth module, then add #[rustfmt::skip]
annotations to 7 string expressions where nightly rustfmt's
format_strings option corrupts \n escape sequences. This satisfies
the CI format check while preserving correct SigV4 string semantics.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Collapse let = \n "string" into let = "string" for presigned.rs and
multipart.rs to match CI nightly rustfmt expectations.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The Drop impl cannot be async, so spawn the file removal on the tokio
runtime via Handle::try_current(). Falls back gracefully when no runtime
is active (e.g. test teardown). Fixes clippy disallowed_methods lint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add 19 integration tests covering all new operations:
- DynamoDB (6): tagging, TTL, transactions (write+get, condition failure),
  describe_limits, describe_endpoints
- Lambda (8): layer publish/get/list/delete, ESM create/update/delete/list,
  function concurrency, event invoke config
- IAM (5): OIDC provider CRUD, policy tags, instance profile tags
- EventBridge (5): archive CRUD, connection, API destination

Also fix pre-existing clippy lint: replace std::fs::remove_file with
tokio::fs::remove_file in S3 StoredData Drop impl.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Normalize Lambda API date prefixes for layers (2018-10-31),
  event-source-mappings (2015-03-31), and consolidate concurrency and
  event-invoke-config routes to use 2015-03-31 matching SDK behavior
- Fix EventBridge timestamps: use epoch seconds (float) instead of
  RFC3339 strings for CreationTime/LastModifiedTime
- Fix DynamoDB DescribeLimits test: correct table vs account capacity
  expected values

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add /layers and /event-source-mappings path matching to the gateway's
is_lambda_path() so these requests route to Lambda instead of falling
through to S3.

Fix test_should_put_and_get_function_concurrency to use
get_function_concurrency directly instead of checking get_function
response which doesn't include Concurrency field.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Lambda ESM operations use PascalCase wire format (EventSourceArn, not
eventSourceArn). Fix CreateEventSourceMappingInput,
UpdateEventSourceMappingInput, EventSourceMappingConfiguration, and
ListEventSourceMappingsOutput from camelCase to PascalCase.

Add #[rustfmt::skip] to presigned.rs and multipart.rs test strings
that different nightly versions format inconsistently.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

EventBridge now_timestamp returns i64 epoch seconds (avoids clippy
cast_precision_loss). Lambda ESM last_modified changed from ISO string
to f64 epoch seconds matching the AWS SDK wire format.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…tements

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>