feat: add trusted gateway telemetry capabilities

[alongubkin]

Summary

• add logs-only gateway telemetry capabilities to Manager authentication and authorization
• forward trusted gateway source metadata to the OTLP backend
• add alien logs --source filtering for AI and Encryption Gateway diagnostics

Security

• gateway capabilities are inert outside telemetry ingest
• gateway capabilities can ingest logs only, never traces or metrics
• source classification comes from the authenticated capability rather than the OTLP payload

Validation

• cargo test -p alien-manager providers::oss_authz::tests --lib
• cargo check -p alien-manager --all-targets
• cargo check -p alien-cli --all-targets

Linear: ALIEN-556

[greptile-apps]

Greptile Summary

The PR adds trusted, logs-only gateway telemetry capabilities and exposes gateway-source filtering in the CLI.

• Adds telemetry-specific authentication scopes and signal-level authorization.
• Attaches authenticated gateway source metadata while forwarding OTLP logs.
• Adds alien logs --source filtering and prevents combining gateway sources with deployment filtering.
• Extends AI gateway request diagnostics and upstream metadata forwarding.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/alien-manager/src/auth/subject.rs	Adds narrowly scoped telemetry capability subjects and server-controlled gateway log-source classification.
crates/alien-manager/src/providers/oss_authz.rs	Extends default authorization to permit gateway capabilities only for their allowed telemetry signal.
crates/alien-manager/src/routes/telemetry.rs	Authorizes telemetry by signal and derives forwarding metadata from the authenticated subject.
crates/alien-manager/src/providers/otlp_forwarding.rs	Forwards trusted gateway source metadata to the configured OTLP backend.
crates/alien-cli/src/commands/logs.rs	Adds gateway-source queries and fixes the prior empty-result behavior by rejecting deployment/source combinations.
crates/alien-ai-gateway/src/usage.rs	Extends gateway request diagnostics with request timing and model metadata.
crates/alien-ai-gateway/src/router/mod.rs	Propagates request diagnostics context and validated static headers through AI-provider requests.

Sequence Diagram

sequenceDiagram
    participant Gateway as Trusted Gateway
    participant Manager as alien-manager
    participant Authz as Telemetry Authz
    participant OTLP as OTLP Backend
    participant CLI as alien logs
    Gateway->>Manager: OTLP logs with capability bearer
    Manager->>Authz: Authorize Logs signal
    Authz-->>Manager: Allow gateway logs capability
    Manager->>OTLP: Forward logs with trusted source metadata
    CLI->>OTLP: Query by alien.log.source
    OTLP-->>CLI: Gateway diagnostics

Loading

_{Reviews (3): Last reviewed commit: "feat: support AI gateway diagnostics and..." | Re-trigger Greptile}

[greptile-apps]

Too many files changed for review (405 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.