feat: Layer 1 — Proxy & Observability via native Albus integration

[rafaelsandroni]

Summary

• Delete custom guardionAuth middleware (src/middlewares/guardion/) — replaced by native Albus integration. The gateway's existing fetchApiKeyDetails, fetchOrganisationConfig, and fetchOrganisationGuardrail functions work correctly once ALBUS_BASEPATH points at Guard API.
• Remove dead code: isGuardionAuth bypass in authN (was never set), guardion provider VK short-circuit in helpers.ts
• Add configurable telemetry paths: GUARD_LOGS_PATH and GUARD_ANALYTICS_PATH env vars replace hardcoded paths in controlPlane.ts (private-deployment branch only)
• Remove debug console.log from uploadLogsToControlPlane
• Add design spec and implementation plan documenting the Guard API contract (5 endpoints) and all changes

Guard API Contract

The gateway now calls these endpoints natively (no mapping layer):

1. GET /v2/api-keys/self/details — authentication
2. GET /v2/virtual-keys/:slug — LLM provider key resolution
3. GET /v2/configs/:slug — dynamic routing config
4. GET /v2/guardrails/:slug — guardrail definitions
5. POST $GUARD_LOGS_PATH / POST $GUARD_ANALYTICS_PATH — telemetry ingestion

Required Environment Variables

PRIVATE_DEPLOYMENT=ON
ALBUS_BASEPATH=http://guard-api:8000
PORTKEY_CLIENT_AUTH=<service-token>
GUARD_LOGS_PATH=/v1/logs/enterprise/logs          # optional, this is the default
GUARD_ANALYTICS_PATH=/v1/analytics/enterprise/analytics  # optional, default

Test plan

• Build passes (npm run build)
• No broken imports after middleware deletion
• Pre-existing test suite unaffected (no new failures)
• else branch in controlPlane.ts (CONTROL_PLANE_BASEPATH/dp/metrics) untouched
• End-to-end smoke test against running Guard API (Task 8 in implementation plan)

🤖 Generated with Claude Code