fix: map system buckets and keep durable artifacts stable under the tenant-rooted layout #1863

[DmytroZaichenkoDev]

Stacked on #1866.

TenantLayoutTransform handled four bucket locations; the codebase builds descriptors against four more, and each threw under the tenant-rooted layout. These paths are composed off the request path, so the failures took out a subsystem rather than a request:

Location	What breaks
deployment_cost_stats/	per-request cost accounting, on the /v1/deployments path
background_jobs/	background job scanning
response_mappings/	the response id index
api_key_data/	per-request keys, so every application caller

They now map to a reserved .system/ segment at the root, above any tenant — that is what preserves today's behaviour, since the job scheduler scans its bucket whole and all four are keyed by globally unique ids. Whether this state should become tenant-scoped belongs to the phase that turns multi-tenancy on.

The locations move to ResourceDescriptor so a layout can enumerate them, and their callers now reference those constants; a second literal next to the caller is how these came to be missed. An unregistered location still throws rather than falling back silently.

Durable artifacts must not follow the physical path. The seam made getAbsoluteFilePath() layout-dependent, which breaks anything derived from it and then stored:

• Invitation ids encoded the physical path, so getInvitationResource could not parse a pre-flip id back and share-by-link returned 404.
• Encryption AAD at three sites — SecretFieldProcessor (every @EncryptedField on config-managed entities), UserExternalServiceService (user-authored client secrets), BackgroundJobService (the per-request key inside a job record). Ciphertext keeps the AAD it was sealed with; after a layout flip the AAD re-derives differently and decryption tag-mismatches. For config entities the failure is silent: the entity drops out of the merged config as invalid.

All four now use getStableFilePath(), which is byte-identical to the legacy physical path under any layout. SecretFieldProcessorLayoutTest proves it with real AES-GCM: a secret encrypted under the legacy layout decrypts after the flip, and ciphertext bound to the tenant-shaped physical path does not.

Public sub-buckets. ApplicationService keys a public function app's deployment folder as a synthesized sub-bucket, public/deployments/<id>/, which the transform rejected — every deploy of a public app threw under the tenant-rooted layout. Public sub-buckets now keep their legacy suffix under the tenant root; dotted segments are rejected so the mapping stays reversible, since dotted names there are reserved for principal branches and resource-type folders. The private (Users/<sub>/deployments/<id>/) and review (Users/<sub>/publications/<pub>/deployments/<id>/) variants already worked via multi-segment principal ids and are pinned by ApplicationDeploymentLayoutTest alongside the public one.

Reserved names are now enforced. The tenant-rooted tree gives .org/.system/.users/.keys and dotted type folders one namespace, and full-path parsing depends on the reserved names staying unambiguous. No ResourceTypes group takes one today, but nothing kept a future one off them; the transform now rejects the collision, and the every-type round-trip test doubles as the build-time tripwire.

Found by the P1 verification instruments (#1870) and a follow-up audit of physical-path consumers.

🤖 Generated with Claude Code