Add tlog-mirror support

[lukevalenta]

Add tlog-mirror support.

[lukevalenta]

Plan

Building this out via stacked PRs. The crate scaffold and add-checkpoint handler shipped in #237; this comment tracks the remaining work.

C1 — Mirror cosigner key + ticket key + GET /metadata

• ML-DSA-44 mirror cosigner key loaded from MIRROR_SIGNING_KEY PKCS#8 PEM secret. OID-dispatching MirrorSigner enum (cosignature/v1 for Ed25519, subtree/v1 for ML-DSA-44), pattern lifted from the witness's sign-subtree work in Add ML-DSA-44 / sign-subtree support to witness_worker #229.
• 32-byte HMAC-SHA-256 ticket key loaded from base64-encoded MIRROR_TICKET_KEY secret, wrapped in tlog_mirror::TicketMacer.
• GET /metadata endpoint publishing mirror identity, DER-encoded SPKI, mirror_algorithm, prefixes, and per-log config. Response sorted by origin so it's deterministic.
• Dev .dev.vars shipping deterministic dev keys; dev_config_tests pin both load cleanly.

C2 — Extended MirrorState DO with committed checkpoint + commit RPC

• Add CommittedCheckpoint { size, hash, signed_note_bytes } per origin alongside existing PendingCheckpoint.
• POST /get-state RPC: read-only MirrorStateSnapshot { pending, committed }. Used by C4 for early-reject before reading the streaming body.
• POST /commit RPC: atomic, monotone advance of committed. Refuses commits beyond pending (400). Treats stale commits as no-op success returning current state (spec forbids rolling back).

C3 — Subtree consistency proof verification

• tlog_mirror::wire::EntryPackage carries the proof bytes; we need a verifier. Either find an existing helper in tlog_tiles / the post-split tlog_core (Extract Merkle math from tlog_tiles into a new tlog_core crate #231) or write one.
• Likely lands as a small addition to tlog_core so it's reusable; alternatively as a private helper in mirror_worker if generalizing it is awkward.

C4 — add-entries happy-path handler

• Stream-parse the request body via tlog_mirror::wire.
• Per-package proof verification using C3.
• Entry-bundle generation (256-aligned packages map directly to entry bundles per the spec).
• R2 storage writes via generic_log_worker::ObjectBackend.
• Tile (re)computation and upload from new entries.
• Atomic mirror-checkpoint advance via the C2 /commit RPC.
• Mirror cosignature emission via the C1 MirrorSigner.

C5 — add-entries error paths + tests

• 404 for unknown origin (early reject via C2 /get-state).
• 409 with text/x.tlog.mirror-info body when upload_end is not a known pending or upload_start is too far below committed. Ticket scheme (via C1) lets the mirror accept past pendings.
• 422 on subtree consistency proof failure.
• 400 for malformed wire frames, oversized bodies.
• Integration test scenarios extending crates/integration_tests/tests/tlog_mirror.rs.

Out of scope for these slices

• Read interface (GET /<encoded-origin>/checkpoint, /tile/..., /<entries>/...). Reuses generic_log_worker storage primitives; can land independently after C5.
• Cleaner DO for partial-tile cleanup. Reuses generic_log_worker::cleaner_do; minimal worker-specific code.
• Pruning policy.

PR map

• Add tlog_mirror crate with wire format and default ticket authenticator #236 — tlog_mirror wire-format crate.
• Add mirror_worker crate with add-checkpoint handler #237 — mirror_worker skeleton + add-checkpoint handler.
• C1 + C2 (in flight) — keys + /metadata + extended MirrorState DO.
• C3 — subtree consistency proof verification.
• C4 — add-entries happy path.
• C5 — add-entries error paths + integration tests.
• Read interface (separate PR).
• Cleaner DO (separate PR).