Add o11y_oauth_application_id setting for BFF auth
What does this MR do?
Second MR in the observability BFF session broker split (database → settings/config → backend → frontend). Targets !249286 (merged) (the database MR) since it wires the new column into the model.
Wires the o11y_oauth_application_id column (added in !249286 (merged)) into ApplicationSetting as a belongs_to association.
Also adds filesystem-based Settings.observability.bff_mtls configuration (certificate_file, private_key_file, listener_host, listener_port) for the mTLS client cert GitLab Rails will present when calling the SigNoz BFF session-exchange endpoint. This is a single shared, fleet-wide secret, so it lives on disk rather than in an encrypted ApplicationSetting column.
No code reads these settings yet -- that lands in a follow-up MR.
References
- gitlab-org/embody-team/experimental-observability/documentation#101
- gitlab-org/embody-team/experimental-observability/documentation#163 — local dev setup guide for this feature
- Depends on !249286 (merged)
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.