feat(server): Add validation details to upstream auth logs [SAO-17523]

[josjeon]

Why

During the September 23 multitenant incident, Orbit rejected two authorization checks with 422 responses, and Agent Control returned 502. Agent Control's warning named the operation and status, but gave us no way to tell which field Orbit rejected. We still do not have the original caller payload, so the incident's root cause is unconfirmed.

This PR makes the next rejection easier to diagnose from the logs. It is the scoped change for SAO-17523.

Before and after

What changed

When the upstream authorization service returns an unexpected 4xx, the warning now includes:

• The operation and upstream status.
• Whether target context was sent, plus the shape of target_type and target_id (for example, string:len=10 rather than the value).
• Up to five validation errors, showing a recognized error kind and field path. The log also marks the summary as parsed, oversized, or unusable; the total count is unknown when it cannot be computed.

The details appear in the warning text and structured log fields, so they survive plain text, Agent Control JSON, and Orbit's host managed logging. The API response is unchanged: the same rejection still returns 502 with AUTH_UPSTREAM_REJECTED.

Illustrative outcomes (the original incident payload was not captured):

Scenario	Client response	Agent Control log
Invalid target rejected locally	422 VALIDATION_ERROR; Orbit is not called	No upstream diagnostic warning
Orbit returns a parseable validation error	502 AUTH_UPSTREAM_REJECTED	Field path and error type, without caller values
Orbit returns an oversized or unusable error body	Same 502 response	oversized or unusable; validation count is unknown

Keeping caller data out of logs

The summary drops validation messages, inputs, and context values. It logs only known error kinds and field names; unknown entries become other or <other>. Each field path is limited to four parts, and the error list is limited to five entries. Bodies over 64 KiB are marked oversized; deeply nested, malformed, or non JSON bodies are marked unusable. These cases produce an empty summary with an unknown count without changing the API response. A parsed empty list has a count of 0.

Verification and rollout

• 156 auth framework and logging utility tests passed locally; one test that needs the usual setup fixture was deselected. Ruff and mypy passed.
• PR CI passed on the pushed commit, including server checks, UI, TypeScript SDK, image build, and Codecov patch coverage.
• The full local check could not start offline because splunk-ao==0.4.0 was not cached. The full server suite also needs PostgreSQL, which was unavailable locally.
• No migration or configuration change is needed. Revert this PR to roll back. Multitenant staging validation still needs a deployable image after merge.

This change helps identify a future recurrence or equivalent reproduction. It does not establish or fix the original malformed payload. Local runtime token request validation is covered separately by #268.

Checklist

• Linked issue: SAO-17523, a subtask of SAO-17418.
• No API or configuration documentation change needed.
• PR CI passed on the pushed commit.
• Multitenant staging validation after merge.

AI Tool Assistance Usage Statement

• AI assistance was used to draft parts of the implementation, which were subsequently modified and extended.
• AI assistance was used in generating tests and documentation for this change.
• AI assistance was used for optimizing and troubleshooting existing code in this change.
• AI assistance was used to draft this entire change as is.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!