feat: conditional route mounting for standalone vs integrated mode

Description

Refactor public.rs and partner.rs handlers from State<AppState> to Extension<ReportSink>. Refactor api_key_auth.rs middleware from Extension<ApiKeyState> to Extension<Arc<ApiKeyLookup>>. Split main.rs into boot_integrated() (current behavior) and boot_standalone() (no DB/MQ/JWT, only public+partner routes).

Standalone mode mounts only /public/v1, /partner/v1, /healthz, and UI routes. Internal routes (/v1/intake) are only available in integrated mode.

Acceptance Criteria

  • public.rs handlers extract Extension<ReportSink> instead of State<AppState>
  • partner.rs handlers extract Extension<ReportSink> instead of State<AppState>
  • api_key_auth.rs extracts Extension<Arc<ApiKeyLookup>> instead of Extension<ApiKeyState>
  • main.rs split into boot_integrated() and boot_standalone()
  • Standalone mode: no DB, no MQ, no JWT, no internal routes
  • Health check includes mode field (integrated/standalone)
  • All 42+ existing integration tests pass (integrated mode unchanged)

Context & References

  • Plan: docs/modules/ROOT/pages/plans/intake-standalone-mode.adoc (Steps 3-7)
  • Epic: &9 (closed)
  • Service: craig-intake
  • Branch: feature/intake-conditional-routes

Key Files

  • services/craig-intake/src/api/public.rs — change handler signatures
  • services/craig-intake/src/api/partner.rs — change handler signatures
  • services/craig-intake/src/api/api_key_auth.rs — change middleware
  • services/craig-intake/src/api/mod.rs — fix return types
  • services/craig-intake/src/main.rs — split boot functions
Edited by Ghost User