fix(credentials): require host identity for role_arn accounts without an ARN

[cristim]

What

Items 3 and 4 of #402. Items 1 and 2 (API-key revocation) landed in #492, so this PR closes #402.

Item 3: role_arn with no ARN on a non-host account. An AWS account with aws_auth_mode=role_arn and an empty aws_role_arn is the "self account" shape: CUDly serves it with the host's own ambient credentials. Nothing checked that the account was the host. A tenant account configured as role_arn with the ARN left out got:

• recommendation collection against the host account's resources, filed under the tenant account's UUID (scheduler.collectAWSForAccount ambient branch), and
• the host's ambient credentials in purchase execution and the commitment-options probe (credentials.resolveRoleARNProvider).

The fix adds credentials.VerifyHostAccount. It compares the account's external_id with the host's sts:GetCallerIdentity account and returns the typed credentials.ErrNotHostAccount on a mismatch, an STS error, a missing STS client, or an empty identity. Both ambient paths call it before they hand out ambient credentials. Callers wire AmbientSTS (the STS client already built from the same awsCfg as the ambient provider) in purchase/execution.go and server/app.go. The scheduler reuses its existing stsClient. The per-account error goes through the existing fan-out failure reporting.

Item 4. SetupAdminRequest.password now says "Base64-encoded password", as LoginRequest.password already did. PasswordResetConfirm.new_password had the same gap (its handler also calls decodeBase64Password), so it gets the same note. No generated client or frontend contract mirrors these schemas.

Not in this PR

• Account create/update validation (validateAWSAuthMode) still accepts role_arn with no ARN for any external_id. The runtime check is the guard that fails closed, because existing rows skip validation. A create-time rejection is a possible follow-up.
• POST /api/accounts/:id/test (awsAmbientCredResult) still reports "ambient credentials (CUDly host account)" for this shape without probing. It is a status message and no credentials are used, but it is misleading for a non-host account.

How verified

Toolchain: GOTOOLCHAIN=go1.26.6 GOWORK=off GOFLAGS='-p=2 -count=1' AWS_EC2_METADATA_DISABLED=true

• go build ./..., go vet ./..., go vet -tags integration ./...: clean
• go test ./internal/credentials/ ./internal/scheduler/ ./internal/purchase/ ./internal/server/ ./internal/api/: 3484 passed
• go test -tags integration ./internal/scheduler/ -run Completeness (Postgres testcontainer): 25 passed
• golangci-lint run on the touched packages: no issues

Regression tests (all fixture/mock-based):

• TestScheduler_CollectAWSForAccount_RoleARNWithoutARNOnNonHostFailsClosed: a tenant account (external_id 222222222222) with the host on 999999999999, an STS error, or no STS client must return ErrNotHostAccount and never call CreateAndValidateProvider(ctx, "aws", nil).
• TestResolveAWSCredentialProvider_SelfAccount_NonHostFailsClosed: covers mismatch, empty external_id, empty host identity (so "" == "" cannot pass), STS error, and a nil client.
• TestResolveAWSProvider_RoleARNWithoutARNOnNonHostFailsClosed: covers the purchase path, for both the non-host case (rejected) and the host case (ambient credentials returned).
• TestOpenAPIPasswordFieldsDocumentBase64: covers the spec.

Failing before the fix: with only the two VerifyHostAccount call sites disabled (scheduler.go, resolver.go):

--- FAIL: TestResolveAWSCredentialProvider_SelfAccount_NonHostFailsClosed
    Error: Expected error with "credentials: aws_role_arn is empty but the account is not confirmed as the CUDly host account" in chain but got nil.
--- FAIL: TestScheduler_CollectAWSForAccount_RoleARNWithoutARNOnNonHostFailsClosed
    mock: I don't know what to return because the method call was unexpected.   (the host-credential provider was requested)
--- FAIL: TestResolveAWSProvider_RoleARNWithoutARNOnNonHostFailsClosed
    Error: Expected error with "credentials: aws_role_arn is empty but ..." in chain but got nil.

With the openapi.yaml change stashed:

--- FAIL: TestOpenAPIPasswordFieldsDocumentBase64
    Error: "" does not contain "Base64-encoded"   Messages: SetupAdminRequest.password
    Error: "" does not contain "Base64-encoded"   Messages: PasswordResetConfirm.new_password

Mutation check: changing the external_id comparison in VerifyHostAccount to if false && ... fails the credentials and scheduler regression tests. Reverted.

Not verified against a real AWS account. The STS identity comparison is exercised only through fakes.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 11 billable files and costs up to $2.75.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 49 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 60 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: a1e24fe7-4227-443c-9fab-98c9adb0afb1

📥 Commits

Reviewing files that changed from the base of the PR and between d384d47 and b07241c.

📒 Files selected for processing (11)

• internal/api/openapi.yaml
• internal/api/openapi_password_encoding_test.go
• internal/credentials/host_identity.go
• internal/credentials/resolver.go
• internal/credentials/resolver_test.go
• internal/purchase/coverage_extra_test.go
• internal/purchase/execution.go
• internal/scheduler/recommendation_completeness_integration_test.go
• internal/scheduler/scheduler.go
• internal/scheduler/scheduler_test.go
• internal/server/app.go

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}