anchorage v1.0 initial tree

Greenfield Go multi-tenant IPFS Pinning Service wire-compatible with the
IPFS Pinning Services API spec. Paired 1:1 with Kubo over localhost RPC,
clustered via embedded NATS JetStream, Postgres source-of-truth with
RLS-enforced tenancy, Fiber + huma v2 for the HTTP surface, Authentik
OIDC for session login with kid-rotated HS256 JWT API tokens.

Feature-complete against the 22-milestone build plan, including the
ship-it v1.0 gap items:

  * admin CLIs: drain/uncordon, maintenance, mint-token, rotate-key,
    prune-denylist, rebalance --dry-run, cache-stats, cluster-presences
  * TTL leader election via NATS KV, fence tokens, JetStream dedup
  * rebalancer (plan/apply split), reconciler, requeue sweeper
  * ristretto caches with NATS-backed cross-node invalidation
    (placements live-nodes + token denylist)
  * maintenance watchdog for stuck cluster-pause flag
  * Prometheus /metrics with CIDR ACL, HTTP/pin/scheduler/cache gauges
  * rate limiting: session (10/min) + anonymous global (120/min)
  * integration tests: rebalance, refcount multi-org, RLS belt
  * goreleaser (tar + deb/rpm/apk + Alpine Docker) targeting Gitea

Stack: Cobra/Viper, Fiber v2 + huma v2, embedded NATS JetStream,
pgx/sqlc/golang-migrate, ristretto, TypeID, prometheus/client_golang,
testcontainers-go.

internal/pkg/httpserver/middleware.go

@@ -0,0 +1,49 @@
+package httpserver
+
+import (
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/gofiber/fiber/v2"
+
+	"anchorage/internal/pkg/metrics"
+)
+
+// accessLog is a minimal, slog-friendly request logger that also feeds
+// the Prometheus HTTP request counter. Full structured logging with
+// tenant + user attribution lives in the auth middleware once a JWT
+// is validated.
+//
+// /metrics itself is skipped — self-observing scrapes would show up as
+// a ton of 200s that tell the operator nothing.
+func accessLog() fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		start := time.Now()
+		err := c.Next()
+		dur := time.Since(start)
+
+		status := c.Response().StatusCode()
+		lvl := slog.LevelInfo
+		if status >= http.StatusInternalServerError {
+			lvl = slog.LevelError
+		} else if status >= http.StatusBadRequest {
+			lvl = slog.LevelWarn
+		}
+
+		slog.Log(c.UserContext(), lvl, "http",
+			"method", c.Method(),
+			"path", c.Path(),
+			"status", status,
+			"duration_ms", dur.Milliseconds(),
+			"request_id", c.Get(fiber.HeaderXRequestID),
+			"remote", c.IP())
+
+		if c.Path() != "/metrics" {
+			metrics.HTTPRequests.
+				WithLabelValues(c.Method(), metrics.StatusClass(status)).
+				Inc()
+		}
+		return err
+	}
+}