fix(ingestion): bump mcp-chassis to v0.7.1; label refused REST requests by route

1. Rejections are logged. chassis v0.2.0 refused without a log line, so
   since #149 an unknown REST caller got silent 401s. v0.7.1 writes
   `mcp auth rejected` (reason, remote, token fingerprint, path) and
   `mcp auth accepted` per authenticated request. Tested through
   buildMux.

2. Fallout: since chassis v0.7 (mcp-chassis#4) NewJWTValidator no longer
   fails on OIDC discovery; the issuer resolves lazily and a JWT gets
   503-and-retry until it does. #83's boot retry loop therefore never
   retried, and its tests failed. buildJWTValidator now builds once and
   logs an issuer still unresolved at boot. Behaviour change: a
   misconfigured issuer no longer exits the process; JWTs get 503, the
   static bearer keeps working. internal/startupretry is now unused.

3. Metrics: authenticated REST requests were already labelled by route
   (the REST mux sets Pattern on the same *http.Request the middleware
   reads). Requests refused by auth never reached the REST mux and were
   labelled path="/". labelRESTPattern now sets the REST route's pattern
   before auth; unmatched paths keep "/", so the label set stays bounded.

Closes #155

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/jwt_validator.go

@@ -2,24 +2,25 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 
 	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 )
 
-// buildJWTValidator runs OIDC discovery under policy, so a 502 from an auth
-// upstream that is not serving yet on a cold boot is retried instead of
-// exiting (#83). It honours ctx between attempts.
-func buildJWTValidator(
-	ctx context.Context, logger *slog.Logger, issuer, audience string, policy startupretry.Policy,
-) (*chassisauth.JWTValidator, error) {
-	return startupretry.Do(ctx, policy, func(ctx context.Context) (*chassisauth.JWTValidator, error) {
-		v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
-		if err != nil {
-			logger.Warn("oidc discovery not ready, retrying", "err", err)
-		}
-		return v, err
-	})
+// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
+// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
+// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
+// and until it does a JWT is answered 503-and-retry, not 401. That replaces
+// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
+// boot is logged, so a misconfigured issuer is visible rather than silent.
+func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
+	v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
+	if err != nil {
+		return nil, fmt.Errorf("build jwt validator: %w", err)
+	}
+	if ok, rerr := v.Ready(ctx); !ok {
+		logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
+	}
+	return v, nil
 }