feat(filter): add grid ingress trust enforcement

[nerdalert]

Summary

This PR adds the grid_ingress_trust HTTP filter for enforcing downstream mTLS peer identity policy.

grid_ingress_trust is the policy layer that consumes the peer identity captured by the TLS/request-context work in #801. It lets a Praxis gateway fail closed unless the downstream client certificate matches an explicitly trusted peer identity.

This is needed for Grid gateway-to-gateway ingress enforcement: a provider-side gateway can require that inbound requests come from an expected consumer gateway identity before allowing the request to proceed.

Included in this PR:

• adds the grid_ingress_trust HTTP filter
• reads downstream mTLS peer identity from request context
• supports trusted peer matching by:
  • certificate digest
  • organization
  • serial number
• rejects requests when peer identity is missing
• rejects requests when peer identity is present but does not match policy
• allows requests when any configured trusted peer rule matches
• keeps enforcement local to request context; no request-time network, control-plane, or database lookups
• adds generated filter documentation
• adds focused unit coverage for match behavior and fail-closed paths

Behavior

The filter is intentionally fail-closed.

Request flow:

1. The TLS layer verifies the downstream client certificate and stores peer identity in request context.
2. grid_ingress_trust reads that peer identity.
3. If no peer identity is present, the request is rejected.
4. If peer identity is present but does not match any configured trusted peer rule, the request is rejected.
5. If a trusted peer rule matches, the request continues.

Trusted peer rules can match against certificate identity fields exposed by #801:

• certificate digest
• organization
• serial number

This keeps certificate parsing and TLS details centralized in the TLS/request-context layer while keeping authorization policy in the HTTP filter layer.

Stack

Depends on:

• feat(tls): expose downstream mTLS peer identity to HTTP filters #801 — feat(tls): expose downstream mTLS peer identity to HTTP filters

This PR is logically stacked on #801 because it consumes the peer identity added there. It can remain draft until #801 lands, then be rebased onto main.

Validation

• Added focused grid_ingress_trust unit coverage for peer identity matching and fail-closed behavior.
• Verified targeted filter coverage:
• cargo test -p praxis-proxy-filter grid_ingress_trust → 23 passed
• Verified full Grid gateway-to-gateway mTLS trust validation passed 10/10 using the combined Praxis validation branch:
  nerdalert/praxis:ai-grid-g2g-demo-validation.
• See the validation package in nerdalert/praxis-research-spikes.