feat(swift): add Connection pool and configurable ETag mismatch policy

[nledez]

• Problem

  SwiftBackend shares a single swiftclient.Connection across all calls. Under gevent or threaded workers, multiple greenlets/threads write to the same HTTP socket concurrently
  and corrupt the auth-token state, which causes:

  • Sporadic 400s and ConnectionReset errors
  • Silent content corruption (object written ≠ object read)
  • No write-side integrity guarantee — Swift's returned ETag is never verified against the local MD5
  • list_files() caps at 10 000 objects (no full_listing)
  • read_chunks() never releases its connection → slot leak
  • Tests inherit an app fixture without app_context nor request_context → RuntimeError: Working outside of application context on recent Flask
  • Crypto tests leave encrypted.bin / decrypted.txt in cwd on every run

• Solution

  Per-process Connection pool + ETag verification with configurable policy + test fixture cleanup.

  Swift backend

  • Per-process Connection pool (gevent.queue.Queue with stdlib queue.Queue fallback). Configurable pool_size (default 20), pool_timeout raising PoolExhaustedError (default
    30s).
  • write() pre-computes content_length + ETag (MD5) and verifies the ETag returned by Swift.
  • New etag_mismatch_policy setting:
    • "log" (default, legacy behavior) — log error, keep the object
    • "raise" — log + raise ClientException, keep the object
    • "raise_and_delete" — log + delete + raise ClientException
  • read_chunks() returns the connection to the pool when the generator is exhausted or close() is called (via _PoolReleasingStream).
  • list_files() passes full_listing=True.
  • timeout (60s) and retries (5) passed to every Connection.
  • os_options merged on top of tenant_name / region_name (Keystone v3).

  Tests

  • app fixture pushes test_request_context() + SERVER_NAME=localhost in TestConfig → url_for, current_app, request available out of the box.
  • tests/test_crypto.py uses tmp_path instead of writing to cwd.
  • New tests/test_swift_pool.py (skipped without gevent): concurrent writes, concurrent reads, pool_size enforcement, ETag mismatch with raise_and_delete policy.
  • gevent>=24.0.0 added to requirements/test.pip.

  Compatibility

  • No runtime breaking change: default etag_mismatch_policy="log" = legacy behavior.
  • All new settings optional with sane defaults.

  Tests

  • pytest: 212 passed (before fix: 57 failed / 155 passed).
  • Pool tests require a local Swift on 127.0.0.1:8085 (e.g. docker run -p 8085:8080 fnndsc/docker-swift-onlyone).