feat(auth): classify rejected gateway credentials in authentication events - #4655

Summary

When an authenticator rejects a presented credential, the gateway now emits an OCSF Authentication event that names the mechanism and a low-cardinality reason category. Previously only credential-less requests were recorded (#4632). Callers receive exactly the same gRPC status as before.

Related Issue

Refs #2912

This is the second of several PRs that together satisfy #2912, so it does not close the issue. The remaining work is listed under Follow-ups.

Changes

• Authenticators return an AuthRejection (mechanism, reason, and the status sent to the caller) instead of a bare Status. There is no blanket conversion to Status, so dropping the classification has to be explicit.
• A new Declined outcome lets an authenticator report a credential it rejected while the chain still falls through to other authenticators. A decline only classifies the request when no other authenticator accepts or rejects it. The peer authenticator declines tokens that TokenReview rejects.
• Classification per mechanism:
  • OIDC (OpenID): expired, issuer/audience mismatch, malformed, invalid signature/key/algorithm, and JWKS refresh failures as identity_provider_unavailable.
  • sandbox_jwt: session token verification errors, plus persisted-identity checks (unknown_identity for deleted sandboxes, stale_identity for replaced runtimes, revoked epochs, and consumed tokens).
  • k8s_service_account: TokenReview/pod lookup outages, audience mismatch, wrong service account or labels, replaced pods, and invalid pod bindings.
  • compute_driver: classified by the driver's gRPC status code.
• RefreshSandboxToken defers lineage checks to its handler, which now emits the same event for its own authentication rejections.
• AuthMechanism and AuthFailureReason live with the authentication model. Category strings, severities, and OCSF protocol mapping stay in auth/audit.rs.
• Docs: ocsf-json-export.mdx lists mechanism labels and the reason/severity table.

Events never include presented credentials, headers, or verification error text. An unverified token payload is never used for classification.

Testing

• cargo nextest run -p openshell-server -p openshell-ocsf (2465 passed)
• cargo clippy --workspace --all-targets -- -D warnings
• Unit tests added/updated: per-mechanism classification, chain decline semantics, router and refresh-handler emission with unchanged caller status, secret canaries
• E2E tests added/updated (not applicable)

Follow-ups

• Peer address and request correlation on authentication events (next PR in this stack)
• Opt-in authentication success events
• Authorization denial events (API Activity), with a dual-emitted Detection Finding for cross-sandbox and admin-only attempts by sandbox principals
• Remaining paths: SSH tokens and IssueSandboxToken

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)