feat(cmd): Add authbridge-proxy and authbridge-envoy lite binaries

[huang195]

Summary

Adds two single-mode, single-purpose authbridge binaries alongside
the existing "batteries-included" cmd/authbridge:

Binary	Mode	Plugins	Size
cmd/authbridge (existing)	all 3 modes	all 6 in-tree	25 MB / 17 MB stripped
cmd/authbridge-envoy (new)	envoy-sidecar only	jwt-validation + token-exchange	25 MB / 17 MB stripped
cmd/authbridge-proxy (new)	proxy-sidecar only (no Envoy)	jwt-validation + token-exchange	12 MB / 8.0 MB stripped

Motivation: deployments that need only one mode and only the two
auth plugins don't need to pay for gRPC + envoy go-control-plane +
the a2a/mcp/inference parsers + the ext_authz listener. The
majority of the current binary's footprint comes from those deps.

Binary sizes (darwin amd64, Go 1.26.2)

Built with go build and go build -trimpath -ldflags="-s -w":

authbridge (full)       25 MB  →  17 MB  (baseline)
authbridge-envoy        25 MB  →  17 MB  (ext_proc keeps gRPC in)
authbridge-proxy        12 MB  →   8 MB  (-52% unstripped, -53% stripped)

The big win is authbridge-proxy. Dropped from the link graph:

• google.golang.org/grpc
• envoyproxy/go-control-plane
• cncf/xds/go
• envoyproxy/protoc-gen-validate
• google.golang.org/genproto/googleapis/rpc
• google.golang.org/protobuf
• 4 uncompiled plugins (a2a, mcp, inference, token-broker)

authbridge-envoy is marginal on size (ext_proc forces gRPC +
envoy types back in), but adds value as a deployment-story
simplification: one binary that only does envoy-sidecar, can't
misconfigure into other modes.

Container image sizes (linux/amd64)

Real measurements from podman build with
CGO_ENABLED=0 -trimpath -ldflags="-s -w":

Image	Base	Envoy bundled	Size
authbridge:combined (existing — full, with Envoy)	UBI9-micro	yes	141 MB
authbridge:light (existing — full, no Envoy)	distroless/static	no	29.8 MB
authbridge-envoy:lite (new)	UBI9-micro	yes	132 MB
authbridge-proxy:lite (new)	distroless/static	no	11.5 MB

Deltas (apples-to-apples, same base image)

Comparison	Saving
authbridge-proxy:lite vs authbridge:light (distroless, no Envoy)	29.8 → 11.5 MB (−61%)
authbridge-envoy:lite vs authbridge:combined (UBI9 + Envoy)	141 → 132 MB (−6%)

Deltas (cross-profile — if you can switch envoy-sidecar → proxy-sidecar)

Comparison	Saving
authbridge-proxy:lite vs authbridge:combined	141 → 11.5 MB (−92%)

Practical impact

• Proxy-sidecar deployments: 11.5 MB is essentially the floor for a
  Go sidecar image — distroless/static base (~2 MB) plus the binary
  (~9.5 MB Linux-static-stripped). Pull-time and startup on rolling
  updates drop proportionally.
• Envoy-sidecar deployments: the 9 MB image saving is marginal
  because Envoy (87 MB) + UBI9-micro (24 MB) dominate. The value is
  mode lock-in, not size.
• Attack surface: authbridge-proxy:lite contains zero gRPC code,
  zero envoy types, zero parser plugins. Whatever CVE surface those
  carry is gone from that image.

Sample Dockerfiles used for the measurements are added as
follow-up work (see "Out of scope" below).

Prerequisite refactors

1. Parser plugins → subpackages

Three flat parser plugins lived in authlib/plugins/ as files
alongside registry.go:

• a2aparser.go
• mcpparser.go
• inferenceparser.go

Their init() registration was forced into every binary that
imported authlib/plugins (because importing a package runs its
init() regardless of what the binary actually needs). Moved each
to its own subpackage (matching the pattern jwtvalidation/,
tokenexchange/, tokenbroker/ already use). All plugins are now
uniformly opt-in via side-effect import.

Shared parser helpers (JSONRPCRequest, Truncate, DebugBodyMax)
extracted to authlib/plugins/internal/parsercommon/. internal/
keeps them scoped to plugins under this tree.

2. HTTP listeners → authlib

forwardproxy and reverseproxy were under
cmd/authbridge/listener/. They're net/http-only with no gRPC or
envoy dependencies, so they belong in the shared library where any
binary can reuse them. Moved to authlib/listener/.

extproc and extauthz stay under cmd/authbridge/listener/ —
their gRPC/envoy surface is specific to envoy-integration binaries,
and pulling them into authlib/ would drag grpc+envoy into the
shared lib's go.mod.

Updated cmd/authbridge/main.go

All 5 plugins now pulled in via side-effect imports. Preserves
existing binary behavior.

New binary layouts

authbridge/
  authlib/
    listener/
      forwardproxy/          (moved)
      reverseproxy/          (moved)
    plugins/
      a2aparser/             (moved)
      mcpparser/             (moved)
      inferenceparser/       (moved)
      internal/
        parsercommon/        (new)
      jwtvalidation/         (unchanged)
      tokenexchange/         (unchanged)
      tokenbroker/           (unchanged)
  cmd/
    authbridge/              (existing — batteries-included)
      listener/
        extproc/             (stays)
        extauthz/            (stays)
    authbridge-proxy/        (NEW — own module, authlib-only, no gRPC)
      go.mod
      main.go
    authbridge-envoy/        (NEW — own module, depends on authlib +
                              cmd/authbridge via replace for extproc)
      go.mod
      main.go

Both new modules are added to authbridge/go.work so workspace
builds cover them.

Test plan

• go test -race ./... in authbridge/authlib — passes
• go test -race ./... in authbridge/cmd/authbridge — passes
• go build ./... in authbridge/cmd/authbridge-proxy — passes
• go build ./... in authbridge/cmd/authbridge-envoy — passes
• gofmt -l on touched files — clean (pre-existing drift in
  pipeline/session_test.go, auth.go, etc. not touched)
• Binary sizes measured locally (darwin amd64) and documented
  above.

No new tests specific to the lite binaries — they are main.go
packages that duplicate the relevant branches of the full binary's
wiring. If drift becomes a concern we can extract a shared setup
helper into authlib/.

Out of scope (follow-ups)

• Dockerfiles for the lite binaries. The existing
  cmd/authbridge/Dockerfile still builds the full binary. Adding
  Dockerfile.proxy and Dockerfile.envoy is a small follow-up
  PR once the release/CI workflows are decided.
• CI builds for the new binaries. Current CI matrix lives in
  .github/workflows/ci.yaml — adding them should be straightforward
  but left as a separate change so this PR is code-only.
• UPX compression recipe for operators who want to push sizes
  further (~5 MB for authbridge-proxy with UPX, at startup-time
  cost).
• Size-optimization README under cmd/authbridge-proxy/ noting
  the build-time tradeoffs.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[evaline-ju]

Well-structured refactoring that cleanly separates parser plugins into opt-in subpackages and introduces two purpose-built lite binaries. The proxy binary achieves a meaningful -61% image size reduction by excluding gRPC/Envoy deps. Import paths are consistently updated, tests migrated correctly, and the parsercommon API is minimal and safe. CI is all green including DCO, CodeQL, Go CI, and Bandit.

Areas reviewed: Go (new binaries, plugin refactoring, module layout), Security (deps, hardcoded secrets)
Commits: 1 commit, signed-off: yes
CI status: all passing (17/17, 1 skipped: Spellcheck)

[evaline-ju]

suggestion: The replace on cmd/authbridge creates a build-time coupling to the full binary's module (needed for extproc/extauthz listeners). The PR body explains this well, but a one-line comment in go.mod above the replace would help future maintainers understand why it exists and what breaks if cmd/authbridge is refactored.

[evaline-ju]

suggestion: ~270 lines duplicated between authbridge-proxy/main.go and authbridge-envoy/main.go (initLogging, startSignalToggle, startStatServer, health check, shutdown). PR body acknowledges this — fine for now, but worth tracking so drift doesn't sneak in.