feat(credentials): manage declarative credentials through TOML (#2515)

* feat(credentials): manage declarative credentials through TOML

Make managed credentials part of the canonical TOML configuration and
load them before peers can authenticate.

Reuse ConfigRpc hot patches to durably replace the configured credential
set without restarting the instance. Serialize credential mutations so
base, managed, and ephemeral keys cannot race into conflicts.

Remove the managed overlay file format, digest protocol, capability
negotiation, force reconciliation, and database CAS machinery. Redact
credential secrets from debug output and management events. Write
credential-bearing files atomically with private permissions.

* fix(core): release JoinSet reapers with their owners

Pass weak task-set references into background reapers so they cannot
retain the JoinSet they are meant to collect. This lets stale smoltcp
bridge tasks terminate when an IPv4 generation is replaced.

Add ownership and TCP generation-replacement regressions covering the
production port-forward failure.

easytier-proto/build/main.rs

@@ -128,6 +128,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
             ".common.Ipv4Addr",
             ".common.Ipv6Addr",
             ".common.UUID",
+            ".api.manage.ManagedCredentialConfig",
             ".api.manage.VpnPortalConfig",
         ]);
 

easytier-proto/proto/api_config.proto

@@ -29,6 +29,7 @@ message InstanceConfigPatch {
   optional string ipv6_public_addr_prefix = 13;
   optional bool disable_relay_data = 14;
   repeated VpnPortalClientPatch vpn_portal_clients = 15;
+  api.manage.ManagedCredentialSet managed_credentials = 16;
 }
 
 message VpnPortalClientPatch {

easytier-proto/proto/api_manage.proto

@@ -104,6 +104,21 @@ message NetworkConfig {
   optional uint32 socket_mark = 67;
   repeated NetworkPeerConfig peers = 68;
   optional VpnPortalConfig vpn_portal_config = 69;
+  repeated ManagedCredentialConfig managed_credentials = 71;
+}
+
+message ManagedCredentialConfig {
+  string credential_id = 1;
+  string credential_secret = 2;
+  repeated string groups = 3;
+  bool allow_relay = 4;
+  repeated string allowed_proxy_cidrs = 5;
+  int64 expiry_unix = 6;
+  optional bool reusable = 7;
+}
+
+message ManagedCredentialSet {
+  repeated ManagedCredentialConfig entries = 1;
 }
 
 message VpnPortalClientConfig {

easytier-proto/src/api.rs

@@ -335,6 +335,21 @@ pub mod manage {
     #[cfg(feature = "json-rpc")]
     include!(concat!(env!("OUT_DIR"), "/api.manage.serde.rs"));
 
+    impl std::fmt::Debug for ManagedCredentialConfig {
+        fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+            formatter
+                .debug_struct("ManagedCredentialConfig")
+                .field("credential_id", &self.credential_id)
+                .field("credential_secret", &"<redacted>")
+                .field("groups", &self.groups)
+                .field("allow_relay", &self.allow_relay)
+                .field("allowed_proxy_cidrs", &self.allowed_proxy_cidrs)
+                .field("expiry_unix", &self.expiry_unix)
+                .field("reusable", &self.reusable)
+                .finish()
+        }
+    }
+
     impl std::fmt::Debug for VpnPortalConfig {
         fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
             formatter
@@ -379,6 +394,19 @@ mod tests {
         assert!(!debug.contains("private-key-material"));
     }
 
+    #[test]
+    fn managed_credential_debug_redacts_secret() {
+        let credential = super::manage::ManagedCredentialConfig {
+            credential_id: "managed".to_owned(),
+            credential_secret: "private-key-material".to_owned(),
+            ..Default::default()
+        };
+
+        let debug = format!("{credential:?}");
+        assert!(debug.contains("<redacted>"));
+        assert!(!debug.contains("private-key-material"));
+    }
+
     #[derive(Clone, Default)]
     struct WebClientServiceJsonCallHandler;