Per-workspace queue routing for workspace-scoped services (#862)

Workspace identity is now determined by queue infrastructure instead of
message body fields, closing a privilege-escalation vector where a caller
could spoof workspace in the request payload.

- Add WorkspaceProcessor base class: discovers workspaces from config at
  startup, creates per-workspace consumers (queue:workspace), and manages
  consumer lifecycle on workspace create/delete events
- Roll out to librarian, flow-svc, knowledge cores, and config-svc
- Config service gets a dual-queue regime: a system queue for
  cross-workspace ops (getvalues-all-ws, bootstrapper writes to
  __workspaces__) and per-workspace queues for tenant-scoped ops, with
  workspace discovery from its own Cassandra store
- Remove workspace field from request schemas (FlowRequest,
  LibrarianRequest, KnowledgeRequest, CollectionManagementRequest) and
  from DocumentMetadata / ProcessingMetadata — table stores now accept
  workspace as an explicit parameter
- Strip workspace encode/decode from all message translators and gateway
  serializers
- Gateway enforces workspace existence: reject requests targeting
  non-existent workspaces instead of routing to queues with no consumer
- Config service provisions new workspaces from __template__ on creation
- Add workspace lifecycle hooks to AsyncProcessor so any processor can
  react to workspace create/delete without subclassing WorkspaceProcessor

trustgraph-flow/trustgraph/bootstrap/initialisers/default_flow_start.py

@@ -49,53 +49,67 @@ class DefaultFlowStart(Initialiser):
 
     async def run(self, ctx, old_flag, new_flag):
 
-        # Check whether the flow already exists.  Belt-and-braces
-        # beyond the flag gate: if an operator stops and restarts the
-        # bootstrapper after the flow is already running, we don't
-        # want to blindly try to start it again.
-        list_resp = await ctx.flow.request(
-            FlowRequest(
-                operation="list-flows",
-                workspace=self.workspace,
-            ),
-            timeout=10,
+        workspaces = await ctx.config.keys(
+            "__workspaces__", "workspace",
         )
-        if list_resp.error:
+        if self.workspace not in workspaces:
             raise RuntimeError(
-                f"list-flows failed: "
-                f"{list_resp.error.type}: {list_resp.error.message}"
+                f"Workspace {self.workspace!r} does not exist yet"
             )
 
-        if self.flow_id in (list_resp.flow_ids or []):
+        flow = ctx.make_flow_client(self.workspace)
+        await flow.start()
+
+        try:
+
+            # Check whether the flow already exists.  Belt-and-braces
+            # beyond the flag gate: if an operator stops and restarts the
+            # bootstrapper after the flow is already running, we don't
+            # want to blindly try to start it again.
+            list_resp = await flow.request(
+                FlowRequest(
+                    operation="list-flows",
+                ),
+                timeout=10,
+            )
+            if list_resp.error:
+                raise RuntimeError(
+                    f"list-flows failed: "
+                    f"{list_resp.error.type}: {list_resp.error.message}"
+                )
+
+            if self.flow_id in (list_resp.flow_ids or []):
+                ctx.logger.info(
+                    f"Flow {self.flow_id!r} already running in workspace "
+                    f"{self.workspace!r}; nothing to do"
+                )
+                return
+
             ctx.logger.info(
-                f"Flow {self.flow_id!r} already running in workspace "
-                f"{self.workspace!r}; nothing to do"
-            )
-            return
-
-        ctx.logger.info(
-            f"Starting flow {self.flow_id!r} "
-            f"(blueprint={self.blueprint!r}) "
-            f"in workspace {self.workspace!r}"
-        )
-
-        resp = await ctx.flow.request(
-            FlowRequest(
-                operation="start-flow",
-                workspace=self.workspace,
-                flow_id=self.flow_id,
-                blueprint_name=self.blueprint,
-                description=self.description,
-                parameters=self.parameters,
-            ),
-            timeout=30,
-        )
-        if resp.error:
-            raise RuntimeError(
-                f"start-flow failed: "
-                f"{resp.error.type}: {resp.error.message}"
+                f"Starting flow {self.flow_id!r} "
+                f"(blueprint={self.blueprint!r}) "
+                f"in workspace {self.workspace!r}"
             )
 
-        ctx.logger.info(
-            f"Flow {self.flow_id!r} started"
-        )
+            resp = await flow.request(
+                FlowRequest(
+                    operation="start-flow",
+                    flow_id=self.flow_id,
+                    blueprint_name=self.blueprint,
+                    description=self.description,
+                    parameters=self.parameters,
+                ),
+                timeout=30,
+            )
+            if resp.error:
+                raise RuntimeError(
+                    f"start-flow failed: "
+                    f"{resp.error.type}: {resp.error.message}"
+                )
+
+            ctx.logger.info(
+                f"Flow {self.flow_id!r} started"
+            )
+
+        finally:
+            await flow.stop()