Axum: add protected CloudFront Geo metadata provider #432

Description

Provide optional native Geo facts from protected CloudFront metadata through a checked ingress boundary. PR #439 implements the synchronous Geo contract and CloudFront/supplied provider selection on #422, including reconciliation of checked ingress from #409. Main has no Geo module (crates/edgezero-core/src/lib.rs:16). Local databases/checked-reader-IP input remain #438.

Steps to reproduce

Using the selected provider, test verified protected ingress, direct-client spoofing, an ALB forwarding unverified headers, duplicate/malformed assertions, missing subdivision and provider-disabled startup. Test the real protected CloudFront/ALB path separately from local fixtures.

Expected behavior

One immutable request outcome exposes validated country/subdivision facts and provenance with unavailable/partial/error distinctions. No selection means unavailable, no source fallback occurs, and applications retain jurisdiction/consent/permission decisions.

Impact

Untrusted geographic headers can fabricate policy inputs. An ALB subnet alone does not authenticate CloudFront; geography is an estimate rather than residence or consent proof.

Proposed fix

Review/integrate #439 using explicit default-off native selection and early startup validation. Require operator-owned credential-gated CloudFront-to-origin protection, isolated targets, replacement of viewer headers, TLS and documented cache/error-TTL isolation. No AWS SDK/store dependency or automatic infrastructure mutation is needed. Preserve country-only/unknown-subdivision outcomes and portable/WASM boundaries. Keep real deployment qualification and Trusted Server policy adoption separate.

Done when

• Explicit CloudFront provider selection, default-off dependencies and provider availability have focused tests; invalid selected configuration fails before listen without provider fallback.
• Ingress fixtures cover a verified source, direct-client spoofing, an ALB forwarding unverified headers, malformed/duplicate assertions and missing subdivision.
• Consumers can distinguish unavailable or partial geography from a known result. In particular, US country with no state retains an unknown subdivision; the provider makes no claim about which privacy regime applies.
• Documentation shows protected CloudFront deployment guidance, privacy-safe diagnostics, capability limitations and the difference between geographic facts and application policy.
• Existing adapters, native lifecycle behavior and WASM/default dependency checks remain intact. Record fixture evidence separately from any real CloudFront deployment acceptance.

Geo remains optional for general Axum hosting. A downstream profile that depends on geography must demonstrate its configured provider or retain its existing fail-closed behavior. This issue does not authorize changing Trusted Server's consent rules, adding an assumed jurisdiction, or implementing an identity database.

Related

• Parent Make the Axum adapter production-ready for self-hosted deployments #391. Implementation PR Add pluggable native Geo providers and protected CloudFront ingress #439, on Add native celld configuration and KV store providers #437 / PR Add native celld config and KV store providers #422; reconciles feat(axum): add safe diagnostics and trusted proxy metadata #409 checked ingress.
• Local GeoIP Axum: follow up with an explicit local GeoIP provider #438; client metadata Axum ClientInfo #92; AWS stores Add native AWS configuration, secret, and ordinary KV store providers #410 / PR Add native AWS store providers #414 remain separate.
• Downstream Trusted Server #1134.
• CloudFront geographic headers.