feat(gateway): implement routing, auth, and logging for API gateway

[devin-ai-integration]

feat(gateway): implement routing, auth, and logging for API gateway

Summary

This PR implements three core API gateway components for issue #27:

Circuit Breaker (circuit_breaker.lua): Redis-backed fault tolerance with CLOSED/OPEN/HALF_OPEN state machine. Each backend service has configurable failure thresholds, success thresholds for recovery, and timeout periods. Fails open if Redis is unavailable.

GNAP Authentication (gnap_auth.lua): Gateway-level token introspection with role-based access control (ADMIN, MODERATOR, USER). Caches validated tokens in Redis for 5 minutes. Defines public endpoints that bypass auth and role requirements per endpoint pattern.

Request ID Tracking (request_id.lua): UUID v4 request ID generation with X-Request-ID, X-Correlation-ID, and X-Span-ID header propagation for distributed tracing.

nginx config updates: All upstream blocks now use least_conn load balancing with enhanced keepalive settings. All location blocks integrate circuit breaker checks, rate limiting, and request ID tracking. Enhanced JSON log format includes tracing fields. New /internal/circuit-status endpoint for monitoring.

Note: Prometheus metrics integration was intentionally excluded to avoid merge conflicts with another session working on that component.

Review & Testing Checklist for Human

• Validate nginx syntax: Run nginx -t inside the OpenResty container to verify configuration is valid - this was NOT done before PR creation
• Verify resty.http availability: The gnap_auth.lua requires resty.http module - confirm it's installed in the OpenResty Docker image or add it to the Dockerfile
• Confirm GNAP introspect endpoint exists: The auth service must have /gnap/introspect endpoint for token validation to work
• Review PUBLIC_ENDPOINTS list in gnap_auth.lua:49-62: Verify these match the actual public endpoints your API should expose without authentication
• Test circuit breaker behavior: Verify state transitions work correctly when backends fail and recover

Recommended Test Plan

1. Start the Docker Compose stack with Redis and all backend services
2. Verify nginx starts without errors (docker compose logs nginx)
3. Test public endpoints return 200 without auth header
4. Test protected endpoints return 401 without auth header
5. Test with valid GNAP token to verify auth flow
6. Simulate backend failure to verify circuit breaker opens
7. Check /internal/circuit-status endpoint returns service states
8. Verify X-Request-ID appears in response headers and logs

Notes

• Devin session: https://app.devin.ai/sessions/cf7f8da770d14ff396b603f804f3155a
• Requested by: Erkin Alp Güney (@erkinalp)
• Rate limiting was already implemented in feat: implement API Gateway with rate limiting, authentication, and monitoring #33 and is integrated here
• Prometheus metrics excluded per user request to avoid conflicts with parallel session

[devin-ai-integration]

Original prompt from Erkin

Complete the API Gateway development for the 4chan-go-rs v2 project.

Repository: https://github.com/erkinalp/4chan-go-rs
Issue: #27 - API Gateway development

Remaining tasks (rate limiting already done via #33):
- Implement routing and load balancing in Nginx/OpenResty
- Set up authentication/authorization validation at gateway level
- Implement centralized logging and metrics collection

Work in v2/infrastructure/docker/nginx/ and follow the existing patterns for upstream blocks and location routing.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring