mirror_worker: scaffold the crate + config

[lukevalenta]

NOTE(lvalenta): I used AI to help generate this PR, but I've reviewed and approve these changes. The mirror is targeted for an MTC deployment, so we exclude general tlog-mirror support for things like Ed25519 signatures, and bake log numbers into the config.

Add a deployable skeleton for a c2sp.org/tlog-mirror mirror, specialized
for MTC issuance logs. This wires the crate into the workspace and
validates the embedded per-environment config; the submission API,
cosigner keys, per-origin Durable Objects, and read interface follow in
later slices.

[lukevalenta]

/bonk review

[ask-bonk]

PR #260 – mirror_worker: scaffold the crate + config

Overall impression
The new mirror_worker crate is a clean, well‑structured scaffold that follows the existing workspace conventions. The configuration sub‑crate (mirror_worker_config) provides a comprehensive, strongly‑typed config with extensive validation and tests. Build‑time embedding of the per‑environment config works as intended, and the worker entry point correctly initializes logging and serves a simple status route.

Positive points

Area	Observation
Workspace integration	Added to Cargo.toml members and default‑members; uses the standard cdylib crate type and the same worker dependency version as other workers.
Configuration design	Strongly‑typed AppConfig with validate() covering all logical invariants (signed‑note key names, log‑number windows, SPKI parsing, duplicate key IDs).
Schema + validation	JSON Schema matches the Rust struct; build script validates both schema and logical rules, guaranteeing a compile‑time‑safe config.
Tests	config/src/lib.rs includes a thorough test suite covering happy paths and each validation failure case.
Build script	Correctly selects config.<DEPLOY_ENV>.json, validates against schema, runs logical validation, and copies the result to OUT_DIR.
Worker entry point	Minimal but functional: logging level handling, panic hook, and a root status route.
Clippy compliance	#[allow(clippy::wildcard_imports)] is scoped to the worker::* import, matching the existing codebase style.
Documentation	Module‑level doc comments explain the purpose and design of the mirror and its configuration.

Minor suggestions / improvements

1. Expose the compiled config for testing (optional)
   The CONFIG static is pub(crate). If downstream crates or integration tests need to inspect the embedded config, consider making it pub behind a feature flag rather than always public.

2. Avoid unnecessary string clone in AppConfig::validate
KeyName::new(self.mirror_name.clone()) clones the String. Using self.mirror_name.as_str() (if KeyName::new accepts &str) would eliminate the allocation.

3. Add #[must_use] to LogParams::origins
   The method returns a vector of origins that callers are expected to use; marking it #[must_use] helps catch accidental ignores.

4. Schema consistency for clean_interval_secs
   The schema defines a minimum of 1 but the description mentions a default of 3600. Consider adding "default": 3600 to the schema for tools that generate example configs.

5. Future route expansion
   The current fetch handler only serves /. When additional endpoints (e.g., /metadata, /add-checkpoint) are added, ensure they are registered on the same router to keep the pattern consistent with other workers.

Conclusion
The scaffold meets the project's quality standards, passes the logical validation checks, and includes solid test coverage. With the minor tweaks above, it will be ready for the next development slice (submission API, cosigner handling, etc.). No blockers to merge.

github run