feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

7 files changed, 0 insertions, 472 deletions

diff --git a/vendor/android-tzdata/.cargo-checksum.json b/vendor/android-tzdata/.cargo-checksum.json
deleted file mode 100644
index ce22ca81..00000000
--- a/vendor/android-tzdata/.cargo-checksum.json
+++ /dev/null
@@ -1 +0,0 @@
-{"files":{"Cargo.toml":"a87d9acc9827a50c7a96a88720c5dd055cbc08b1144dff95bd572ff977d4a79a","LICENSE-APACHE":"4458503dd48e88c4e0b945fb252a08b93c40ec757309b8ffa7c594dfa1e35104","LICENSE-MIT":"002c2696d92b5c8cf956c11072baa58eaf9f6ade995c031ea635c6a1ee342ad1","README.md":"6dfe0c602dc61eebe118900ed66a2c1f7887b9fe95b36e1c2974c4e8fa7ebd4b","src/lib.rs":"8f421233df83f82e737930ca8a2ad254966334183148bcc170f9c405df230de2","src/tzdata.rs":"78920925b04219910511e9a1f036f468cd2925c0054f280d6a00b106529046e7"},"package":"e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"}
\ No newline at end of file
diff --git a/vendor/android-tzdata/Cargo.toml b/vendor/android-tzdata/Cargo.toml
deleted file mode 100644
index 805128a8..00000000
--- a/vendor/android-tzdata/Cargo.toml
+++ /dev/null
@@ -1,34 +0,0 @@
-# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO
-#
-# When uploading crates to the registry Cargo will automatically
-# "normalize" Cargo.toml files for maximal compatibility
-# with all versions of Cargo and also rewrite `path` dependencies
-# to registry (e.g., crates.io) dependencies.
-#
-# If you are reading this file be aware that the original Cargo.toml
-# will likely look very different (and much more reasonable).
-# See Cargo.toml.orig for the original contents.
-
-[package]
-edition = "2018"
-name = "android-tzdata"
-version = "0.1.1"
-authors = ["RumovZ"]
-include = [
-    "src/**/*",
-    "LICENSE-*",
-    "README.md",
-]
-description = "Parser for the Android-specific tzdata file"
-readme = "README.md"
-keywords = [
-    "parser",
-    "android",
-    "timezone",
-]
-categories = ["date-and-time"]
-license = "MIT OR Apache-2.0"
-repository = "https://github.com/RumovZ/android-tzdata"
-
-[dev-dependencies.zip]
-version = "0.6.4"
diff --git a/vendor/android-tzdata/LICENSE-APACHE b/vendor/android-tzdata/LICENSE-APACHE
deleted file mode 100644
index c61b6639..00000000
--- a/vendor/android-tzdata/LICENSE-APACHE
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1.  Definitions.
-
-    "License" shall mean the terms and conditions for use, reproduction,
-    and distribution as defined by Sections 1 through 9 of this document.
-
-    "Licensor" shall mean the copyright owner or entity authorized by
-    the copyright owner that is granting the License.
-
-    "Legal Entity" shall mean the union of the acting entity and all
-    other entities that control, are controlled by, or are under common
-    control with that entity. For the purposes of this definition,
-    "control" means (i) the power, direct or indirect, to cause the
-    direction or management of such entity, whether by contract or
-    otherwise, or (ii) ownership of fifty percent (50%) or more of the
-    outstanding shares, or (iii) beneficial ownership of such entity.
-
-    "You" (or "Your") shall mean an individual or Legal Entity
-    exercising permissions granted by this License.
-
-    "Source" form shall mean the preferred form for making modifications,
-    including but not limited to software source code, documentation
-    source, and configuration files.
-
-    "Object" form shall mean any form resulting from mechanical
-    transformation or translation of a Source form, including but
-    not limited to compiled object code, generated documentation,
-    and conversions to other media types.
-
-    "Work" shall mean the work of authorship, whether in Source or
-    Object form, made available under the License, as indicated by a
-    copyright notice that is included in or attached to the work
-    (an example is provided in the Appendix below).
-
-    "Derivative Works" shall mean any work, whether in Source or Object
-    form, that is based on (or derived from) the Work and for which the
-    editorial revisions, annotations, elaborations, or other modifications
-    represent, as a whole, an original work of authorship. For the purposes
-    of this License, Derivative Works shall not include works that remain
-    separable from, or merely link (or bind by name) to the interfaces of,
-    the Work and Derivative Works thereof.
-
-    "Contribution" shall mean any work of authorship, including
-    the original version of the Work and any modifications or additions
-    to that Work or Derivative Works thereof, that is intentionally
-    submitted to Licensor for inclusion in the Work by the copyright owner
-    or by an individual or Legal Entity authorized to submit on behalf of
-    the copyright owner. For the purposes of this definition, "submitted"
-    means any form of electronic, verbal, or written communication sent
-    to the Licensor or its representatives, including but not limited to
-    communication on electronic mailing lists, source code control systems,
-    and issue tracking systems that are managed by, or on behalf of, the
-    Licensor for the purpose of discussing and improving the Work, but
-    excluding communication that is conspicuously marked or otherwise
-    designated in writing by the copyright owner as "Not a Contribution."
-
-    "Contributor" shall mean Licensor and any individual or Legal Entity
-    on behalf of whom a Contribution has been received by Licensor and
-    subsequently incorporated within the Work.
-
-2.  Grant of Copyright License. Subject to the terms and conditions of
-    this License, each Contributor hereby grants to You a perpetual,
-    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-    copyright license to reproduce, prepare Derivative Works of,
-    publicly display, publicly perform, sublicense, and distribute the
-    Work and such Derivative Works in Source or Object form.
-
-3.  Grant of Patent License. Subject to the terms and conditions of
-    this License, each Contributor hereby grants to You a perpetual,
-    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-    (except as stated in this section) patent license to make, have made,
-    use, offer to sell, sell, import, and otherwise transfer the Work,
-    where such license applies only to those patent claims licensable
-    by such Contributor that are necessarily infringed by their
-    Contribution(s) alone or by combination of their Contribution(s)
-    with the Work to which such Contribution(s) was submitted. If You
-    institute patent litigation against any entity (including a
-    cross-claim or counterclaim in a lawsuit) alleging that the Work
-    or a Contribution incorporated within the Work constitutes direct
-    or contributory patent infringement, then any patent licenses
-    granted to You under this License for that Work shall terminate
-    as of the date such litigation is filed.
-
-4.  Redistribution. You may reproduce and distribute copies of the
-    Work or Derivative Works thereof in any medium, with or without
-    modifications, and in Source or Object form, provided that You
-    meet the following conditions:
-
-    (a) You must give any other recipients of the Work or
-    Derivative Works a copy of this License; and
-
-    (b) You must cause any modified files to carry prominent notices
-    stating that You changed the files; and
-
-    (c) You must retain, in the Source form of any Derivative Works
-    that You distribute, all copyright, patent, trademark, and
-    attribution notices from the Source form of the Work,
-    excluding those notices that do not pertain to any part of
-    the Derivative Works; and
-
-    (d) If the Work includes a "NOTICE" text file as part of its
-    distribution, then any Derivative Works that You distribute must
-    include a readable copy of the attribution notices contained
-    within such NOTICE file, excluding those notices that do not
-    pertain to any part of the Derivative Works, in at least one
-    of the following places: within a NOTICE text file distributed
-    as part of the Derivative Works; within the Source form or
-    documentation, if provided along with the Derivative Works; or,
-    within a display generated by the Derivative Works, if and
-    wherever such third-party notices normally appear. The contents
-    of the NOTICE file are for informational purposes only and
-    do not modify the License. You may add Your own attribution
-    notices within Derivative Works that You distribute, alongside
-    or as an addendum to the NOTICE text from the Work, provided
-    that such additional attribution notices cannot be construed
-    as modifying the License.
-
-    You may add Your own copyright statement to Your modifications and
-    may provide additional or different license terms and conditions
-    for use, reproduction, or distribution of Your modifications, or
-    for any such Derivative Works as a whole, provided Your use,
-    reproduction, and distribution of the Work otherwise complies with
-    the conditions stated in this License.
-
-5.  Submission of Contributions. Unless You explicitly state otherwise,
-    any Contribution intentionally submitted for inclusion in the Work
-    by You to the Licensor shall be under the terms and conditions of
-    this License, without any additional terms or conditions.
-    Notwithstanding the above, nothing herein shall supersede or modify
-    the terms of any separate license agreement you may have executed
-    with Licensor regarding such Contributions.
-
-6.  Trademarks. This License does not grant permission to use the trade
-    names, trademarks, service marks, or product names of the Licensor,
-    except as required for reasonable and customary use in describing the
-    origin of the Work and reproducing the content of the NOTICE file.
-
-7.  Disclaimer of Warranty. Unless required by applicable law or
-    agreed to in writing, Licensor provides the Work (and each
-    Contributor provides its Contributions) on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-    implied, including, without limitation, any warranties or conditions
-    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-    PARTICULAR PURPOSE. You are solely responsible for determining the
-    appropriateness of using or redistributing the Work and assume any
-    risks associated with Your exercise of permissions under this License.
-
-8.  Limitation of Liability. In no event and under no legal theory,
-    whether in tort (including negligence), contract, or otherwise,
-    unless required by applicable law (such as deliberate and grossly
-    negligent acts) or agreed to in writing, shall any Contributor be
-    liable to You for damages, including any direct, indirect, special,
-    incidental, or consequential damages of any character arising as a
-    result of this License or out of the use or inability to use the
-    Work (including but not limited to damages for loss of goodwill,
-    work stoppage, computer failure or malfunction, or any and all
-    other commercial damages or losses), even if such Contributor
-    has been advised of the possibility of such damages.
-
-9.  Accepting Warranty or Additional Liability. While redistributing
-    the Work or Derivative Works thereof, You may choose to offer,
-    and charge a fee for, acceptance of support, warranty, indemnity,
-    or other liability obligations and/or rights consistent with this
-    License. However, in accepting such obligations, You may act only
-    on Your own behalf and on Your sole responsibility, not on behalf
-    of any other Contributor, and only if You agree to indemnify,
-    defend, and hold each Contributor harmless for any liability
-    incurred by, or claims asserted against, such Contributor by reason
-    of your accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-Copyright [yyyy] [name of copyright owner]
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
diff --git a/vendor/android-tzdata/LICENSE-MIT b/vendor/android-tzdata/LICENSE-MIT
deleted file mode 100644
index 8aa26455..00000000
--- a/vendor/android-tzdata/LICENSE-MIT
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) [year] [fullname]
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/vendor/android-tzdata/README.md b/vendor/android-tzdata/README.md
deleted file mode 100644
index d3f90313..00000000
--- a/vendor/android-tzdata/README.md
+++ /dev/null
@@ -1,20 +0,0 @@
-# android-tzdata
-
-Parser for the Android-specific tzdata file.
-
-## License
-
-Licensed under either of
-
-- Apache License, Version 2.0
-  ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)
-- MIT license
-  ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)
-
-at your option.
-
-## Contribution
-
-Unless you explicitly state otherwise, any contribution intentionally submitted
-for inclusion in the work by you, as defined in the Apache-2.0 license, shall be
-dual licensed as above, without any additional terms or conditions.
diff --git a/vendor/android-tzdata/src/lib.rs b/vendor/android-tzdata/src/lib.rs
deleted file mode 100644
index b6b0e36c..00000000
--- a/vendor/android-tzdata/src/lib.rs
+++ /dev/null
@@ -1,29 +0,0 @@
-//! Parser for the Android-specific tzdata file.
-
-mod tzdata;
-
-/// Tries to locate the `tzdata` file, parse it, and return the entry for the
-/// requested time zone.
-///
-/// # Errors
-///
-/// Returns an [std::io::Error] if the `tzdata` file cannot be found and parsed, or
-/// if it does not contain the requested timezone entry.
-///
-/// # Example
-///
-///  ```rust
-/// # use std::error::Error;
-/// # use android_tzdata::find_tz_data;
-/// #
-/// # fn main() -> Result<(), Box<dyn Error>> {
-/// let tz_data = find_tz_data("Europe/Kiev")?;
-/// // Check it's version 2 of the [Time Zone Information Format](https://www.ietf.org/archive/id/draft-murchison-rfc8536bis-02.html).
-/// assert!(tz_data.starts_with(b"TZif2"));
-/// #     Ok(())
-/// # }
-/// ```
-pub fn find_tz_data(tz_name: impl AsRef<str>) -> Result<Vec<u8>, std::io::Error> {
-    let mut file = tzdata::find_file()?;
-    tzdata::find_tz_data_in_file(&mut file, tz_name.as_ref())
-}
diff --git a/vendor/android-tzdata/src/tzdata.rs b/vendor/android-tzdata/src/tzdata.rs
deleted file mode 100644
index 92e4b621..00000000
--- a/vendor/android-tzdata/src/tzdata.rs
+++ /dev/null
@@ -1,166 +0,0 @@
-//! Logic was mainly ported from https://android.googlesource.com/platform/libcore/+/jb-mr2-release/luni/src/main/java/libcore/util/ZoneInfoDB.java
-
-use core::{cmp::Ordering, convert::TryInto};
-use std::{
-    fs::File,
-    io::{self, ErrorKind, Read, Seek, SeekFrom},
-};
-
-// The database uses 32-bit (4 byte) integers.
-const TZ_INT_SIZE: usize = 4;
-// The first 12 bytes contain a special version string.
-const MAGIC_SIZE: usize = 12;
-const HEADER_SIZE: usize = MAGIC_SIZE + 3 * TZ_INT_SIZE;
-// The database reserves 40 bytes for each id.
-const TZ_NAME_SIZE: usize = 40;
-const INDEX_ENTRY_SIZE: usize = TZ_NAME_SIZE + 3 * TZ_INT_SIZE;
-const TZDATA_LOCATIONS: [TzdataLocation; 2] = [
-    TzdataLocation {
-        env_var: "ANDROID_DATA",
-        path: "/misc/zoneinfo/",
-    },
-    TzdataLocation {
-        env_var: "ANDROID_ROOT",
-        path: "/usr/share/zoneinfo/",
-    },
-];
-
-#[derive(Debug)]
-struct TzdataLocation {
-    env_var: &'static str,
-    path: &'static str,
-}
-
-#[derive(Debug, Clone, Copy)]
-struct Header {
-    index_offset: usize,
-    data_offset: usize,
-    _zonetab_offset: usize,
-}
-
-#[derive(Debug)]
-struct Index(Vec<u8>);
-
-#[derive(Debug, Clone, Copy)]
-struct IndexEntry<'a> {
-    _name: &'a [u8],
-    offset: usize,
-    length: usize,
-    _raw_utc_offset: usize,
-}
-
-pub(super) fn find_file() -> Result<File, io::Error> {
-    for location in &TZDATA_LOCATIONS {
-        if let Ok(env_value) = std::env::var(location.env_var) {
-            if let Ok(file) = File::open(format!("{}{}tzdata", env_value, location.path)) {
-                return Ok(file);
-            }
-        }
-    }
-    Err(io::Error::from(io::ErrorKind::NotFound))
-}
-
-pub(super) fn find_tz_data_in_file(
-    mut file: impl Read + Seek,
-    tz_name: &str,
-) -> Result<Vec<u8>, io::Error> {
-    let header = Header::new(&mut file)?;
-    let index = Index::new(&mut file, header)?;
-    if let Some(entry) = index.find_entry(tz_name) {
-        file.seek(SeekFrom::Start((entry.offset + header.data_offset) as u64))?;
-        let mut tz_data = vec![0u8; entry.length];
-        file.read_exact(&mut tz_data)?;
-        Ok(tz_data)
-    } else {
-        Err(io::Error::from(ErrorKind::NotFound))
-    }
-}
-
-impl Header {
-    fn new(mut file: impl Read + Seek) -> Result<Self, io::Error> {
-        let mut buf = [0; HEADER_SIZE];
-        file.read_exact(&mut buf)?;
-        if !buf.starts_with(b"tzdata") || buf[MAGIC_SIZE - 1] != 0u8 {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidData,
-                "invalid magic number",
-            ));
-        }
-        Ok(Self {
-            index_offset: parse_tz_int(&buf, MAGIC_SIZE) as usize,
-            data_offset: parse_tz_int(&buf, MAGIC_SIZE + TZ_INT_SIZE) as usize,
-            _zonetab_offset: parse_tz_int(&buf, MAGIC_SIZE + 2 * TZ_INT_SIZE) as usize,
-        })
-    }
-}
-
-impl Index {
-    fn new(mut file: impl Read + Seek, header: Header) -> Result<Self, io::Error> {
-        file.seek(SeekFrom::Start(header.index_offset as u64))?;
-        let size = header.data_offset - header.index_offset;
-        let mut bytes = vec![0; size];
-        file.read_exact(&mut bytes)?;
-        Ok(Self(bytes))
-    }
-
-    fn find_entry(&self, name: &str) -> Option<IndexEntry> {
-        let name_bytes = name.as_bytes();
-        let name_len = name_bytes.len();
-        if name_len > TZ_NAME_SIZE {
-            return None;
-        }
-
-        let zeros = [0u8; TZ_NAME_SIZE];
-        let cmp = |chunk: &&[u8]| -> Ordering {
-            // tz names always have TZ_NAME_SIZE bytes and are right-padded with 0s
-            // so we check that a chunk starts with `name` and the remaining bytes are 0
-            chunk[..name_len]
-                .cmp(name_bytes)
-                .then_with(|| chunk[name_len..TZ_NAME_SIZE].cmp(&zeros[name_len..]))
-        };
-
-        let chunks: Vec<_> = self.0.chunks_exact(INDEX_ENTRY_SIZE).collect();
-        chunks
-            .binary_search_by(cmp)
-            .map(|idx| IndexEntry::new(chunks[idx]))
-            .ok()
-    }
-}
-
-impl<'a> IndexEntry<'a> {
-    fn new(bytes: &'a [u8]) -> Self {
-        Self {
-            _name: bytes[..TZ_NAME_SIZE]
-                .splitn(2, |&b| b == 0u8)
-                .next()
-                .unwrap(),
-            offset: parse_tz_int(bytes, TZ_NAME_SIZE) as usize,
-            length: parse_tz_int(bytes, TZ_NAME_SIZE + TZ_INT_SIZE) as usize,
-            _raw_utc_offset: parse_tz_int(bytes, TZ_NAME_SIZE + 2 * TZ_INT_SIZE) as usize,
-        }
-    }
-}
-
-/// Panics if slice does not contain [TZ_INT_SIZE] bytes beginning at start.
-fn parse_tz_int(slice: &[u8], start: usize) -> u32 {
-    u32::from_be_bytes(slice[start..start + TZ_INT_SIZE].try_into().unwrap())
-}
-
-#[cfg(test)]
-mod test {
-    use super::*;
-    use std::fs::File;
-    use std::io::Cursor;
-
-    #[test]
-    fn parse() {
-        let mut archive = File::open("tests/resources/tzdata.zip").unwrap();
-        let mut zip = zip::ZipArchive::new(&mut archive).unwrap();
-        let mut file = zip.by_index(0).unwrap();
-        let mut data = Vec::new();
-        file.read_to_end(&mut data).unwrap();
-        let cursor = Cursor::new(data);
-        let tz = find_tz_data_in_file(cursor, "Europe/Kiev").unwrap();
-        assert!(tz.starts_with(b"TZif2"));
-    }
-}