feat: openapi + mcp remote (proxy) instance backends

[jrosskopf]

Summary

Adds openapi and mcp remote (proxy) instance backends — instance
bodies fetched live on expand from a REST/OpenAPI endpoint (openapi)
or an upstream MCP server (mcp), rather than materialised in DuckDB. The
whole feature was authored across the earlier commits on this branch; this PR
also closes their verification gap — they were written in a session where
the libduckdb-download egress block stopped the local cargo gate from running,
so the code was "compiled-by-construction only". It is now built, clippy-clean,
and full-suite green locally, with real-service wire coverage.

What lands:

• Backend model + registry (escurel-index): openapi/mcp backend kinds,
  the RemoteBinding parser (endpoint / read / write / project), the
  admin external_endpoints registry (base URL + auth server-side, secret never
  in the markdown corpus — the SSRF guard), and the pure projection/templating
  core (fill_template, resolve_projection).
• Live execution at the gateway (escurel-server/remote_backend.rs):
  outbound reqwest transport for openapi (method+path template) and mcp
  (JSON-RPC tools/call / resources/read), auth applied from the registry,
  JSONPath projection. fetch_projection (expand's live read; any failure →
  fail-closed { issue }, never a fabricated body) + write_instance
  (write-back) + probe (reachability).
• MCP tools + dispatch: register_endpoint / list_endpoints /
  delete_endpoint / validate_endpoints / create_remote_instance (admin),
  and write_instance (agent, gated by the target's acl.update via
  may_write_instance, fail-closed). Registered in tools/list.
• Outbound GET /openapi.json: an OpenAPI 3.1 doc generated from the same
  tool schemas tools/list serves.
• Spec: docs/spec/protocol.md §"Remote backends", roadmap note, and a
  discovered-note on the libduckdb egress block.

Test plan

New no-mock wire e2e — real gateway (POST /mcp), real OIDC (TestIssuer),
real DuckDB + FsStore, real reqwest, and real, stateful in-process axum
upstreams on loopback ports (no canned stubs):

crates/escurel-server/tests/remote_backend_tools.rs (4 tests):

• openapi_remote_backend_read_write_over_the_wire — REST CRM; register →
  validate → create → expand (gold) → write admin (PATCH → platinum,
  read-after-write proves the upstream mutated) → write agent (refused, never
  landed).
• mcp_remote_backend_read_write_over_the_wire — JSON-RPC KB (tools/call,
  stateful putArticle); same walk (draft → published).
• openapi_bearer_auth_forwarded_and_read_degrades_when_unauthorised — a
  guarded upstream: registered bearer is forwarded and never echoed by
  list_endpoints; flipping to auth=none makes the read fail closed to
  { issue }.
• openapi_unreachable_endpoint_degrades_read_and_probe — dead port →
  validate_endpoints unreachable + read degrades to { issue }.

Each behaviour was verified red→green by mutating the feature and watching
the right assertion fail, then restoring. Plus the pre-existing
escurel-index/tests/endpoints.rs (registry roundtrip / secret-not-in-corpus /
survives-rebuild).

Full local gate green: cargo fmt --check,
cargo clippy --workspace --all-targets -- -D warnings,
cargo test --workspace --all-targets, cargo build --workspace --release.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[jrosskopf]

Codex second-opinion review (CLAUDE.md principle 9)

Ran codex exec review --base main focused on design / security / stability / missing functions, with SSRF, secret handling, the write_instance ACL gate, and the fail-closed degraded read called out for scrutiny. Nothing flagged on the security surface (registry-gated egress, secret-never-echoed, ACL gate, fail-closed reads). Two P2 correctness findings, both now addressed in 0cea744:

✅ Fixed — endpoint protocol mismatch not rejected (remote_backend.rs)

exec chose the transport purely from the skill's remote.kind and never checked the registered endpoint's kind; create_remote_instance only checks the endpoint name exists. So an openapi skill pointing at an endpoint registered as mcp (or vice-versa) would dispatch the wrong protocol — and against a matching server, silently return data instead of failing closed. exec now rejects ep.kind != remote.kind, degrading the read to an { issue } naming both kinds. New test remote_read_fails_closed_on_endpoint_protocol_mismatch, verified red→green (with the guard disabled it observes the mismatched read silently returning the CRM row).

✅ Fixed (docs) — write-path placeholder templating overstated

The RemoteOp::Http doc comment and protocol.md both claimed OpenAPI path placeholders are "filled from the overlay id / write payload", but only {id} (from the overlay id) is bound — a multi-placeholder write path (e.g. /customers/{id}/orders/{order_id}) is rejected as unfilled path placeholders. Corrected both to state the real contract (the payload merges into MCP tool-call arguments, not into OpenAPI path templates). Actually filling path placeholders from the payload is left as a follow-up — not documented as supported, so this is an enhancement rather than a regression.

Full local gate green after the fix: fmt --check, clippy --workspace --all-targets -D warnings, test --workspace --all-targets (remote-backend suite now 5 tests), build --workspace --release.

[jrosskopf]

Follow-up landed: complex path + body placeholders (5f2216c)

Closes the enhancement flagged in the codex review (payload-derived path placeholders). The write path now binds far more than {id}:

• Path/URI placeholders resolve from {id} (overlay slug) plus every scalar leaf of the write payload, flattened to dotted keys — /customers/{id}/orders/{order_id} and {customer.tier} both fill.
• OpenAPI body: template (optional on a write op): an exact "{name}" leaf substitutes type-preserving (a number stays a number, an object stays an object); embedded {name} interpolates as a string; objects/arrays recurse. Absent body: → payload sent verbatim (back-compat).
• Both fail closed on an unresolved placeholder (unfilled path/body placeholders), never sending a literal {x}.

Pure core (template_vars / render_body) lives in escurel-index with 6 unit cases; new wire test openapi_write_fills_path_and_body_placeholders_from_payload drives a POST /customers/acme/orders/o-1 with a body template against a real stateful axum orders CRM and reads the order back (verified red→green — disabling the payload merge leaves {order_id} unfilled and the write fails closed). Spec updated in protocol.md.

Full gate green: fmt, clippy --workspace --all-targets, test --workspace --all-targets (remote-backend suite now 6 tests), release build.