feat: Add Network Mirror Protocol for OpenTofu / HashiCorp Registries

[tonedefdev]

Summary

Closes #79
Closes #78
Closes #68
Closes #65

This release adds Provider Network Mirror support for OpenTofu and Terraform while preserving canonical provider identities in configuration and dependency lockfiles.

It also introduces a complete local Tilt environment for testing the mirror over trusted HTTPS and includes the dependency, authentication, RBAC, container, and logging hardening identified during release review.

The Helm chart version and appVersion are bumped to 0.10.0.

Provider Network Mirror

• Add the namespace-scoped Provider Network Mirror endpoint:
  https://<host>/opendepot/providers/mirror/v1/<kubernetes-namespace>/
• Preserve canonical provider identities such as:
  • registry.opentofu.org/hashicorp/aws
  • registry.terraform.io/hashicorp/aws
• Add spec.providerConfig.upstreamRegistry.
• Allow registry.opentofu.org and registry.terraform.io.
• Default omitted or blank registry values to registry.opentofu.org.
• Use the selected registry for provider discovery, downloads, generated resources, UI snippets, and mirror routing.
• Require exact origin, namespace, provider type, version, operating system, and architecture matches.
• Return relative archive URLs and packed ZIP checksums required by the mirror protocol.
• Add controller coverage for registry-origin propagation and Terraform source resolution.

Local Development

• Add a trusted mkcert TLS proxy at:
  https://opendepot.localtest.me:8443
• Support Provider Network Mirror testing from both OpenTofu and Terraform.
• Add writable development containers for Tilt live updates.
• Generate the local Dex/UI client credential during bootstrap instead of committing it.
• Keep insecure HTTP OIDC behavior restricted to explicit development mode.
• Remove the unused OpenTofu CLI binary from production and Tilt images.

Security Hardening

• Verify UI OIDC ID tokens against issuer JWKS.
• Enforce token signature, issuer, audience, authorized party, expiry, and nonce.
• Restrict discovered OIDC endpoints to the configured issuer origin.
• Reject redirected OIDC discovery, token, and JWKS requests.
• Enable Valkey ACL authentication by default.
• Pin Valkey to the reduced-surface 8-alpine image.
• Require matching Valkey Secret names in production configurations.
• Move controller Secret access from ClusterRoles into namespace-scoped Roles.
• Remove tracked Tilt OIDC credentials.
• Redact signed provider URL userinfo, query parameters, and fragments from errors, status, and logs.
• Upgrade Go builders, Go dependencies, UI dependencies, Next.js, and Trivy.
• Remove stale Trivy suppressions.
• Add a root .dockerignore to exclude local state and build artifacts.

Upgrade Notes

Valkey authentication is now enabled by default. Before deployment, create a Secret containing the default ACL password:

kubectl create secret generic opendepot-valkey-auth \
  --namespace opendepot-system \
  --from-literal=default='<password>'

Custom Secret names must match in both:

valkey:
  auth:
    usersExistingSecret: custom-valkey-auth

server:
  stats:
    valkeyPasswordSecretName: custom-valkey-auth

Provider resources may select their canonical upstream registry:

spec:
  providerConfig:
    upstreamRegistry: registry.terraform.io

Existing resources that omit this field continue to use registry.opentofu.org.

Validation

• Depot controller tests and go vet
• Provider controller tests and go vet
• Version controller tests and go vet
• OIDC verification and redirect security tests
• UI production build
• Recursive Yarn security audit
• Helm lint
• Default, Tilt, namespace-scoped, and confidential-client Helm renders
• Trivy chart and filesystem secret/misconfiguration scans
• Server, UI, Depot, Module, Provider, Version, embedded Trivy, and Valkey image scans
• Zero unsuppressed HIGH or CRITICAL vulnerability findings
• Documentation build
• Full end-to-end suites in PR CI