feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 67 deletions

diff --git a/vendor/logos-codegen/src/generator/leaf.rs b/vendor/logos-codegen/src/generator/leaf.rs
deleted file mode 100644
index 0841a4ff..00000000
--- a/vendor/logos-codegen/src/generator/leaf.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-use proc_macro2::TokenStream;
-use quote::quote;
-
-use crate::generator::{Context, Generator};
-use crate::leaf::{Callback, Leaf};
-use crate::util::MaybeVoid;
-
-impl Generator<'_> {
-    pub fn generate_leaf(&mut self, leaf: &Leaf, mut ctx: Context) -> TokenStream {
-        let bump = ctx.bump();
-
-        let ident = &leaf.ident;
-        let name = self.name;
-        let this = self.this;
-        let ty = &leaf.field;
-
-        let constructor = match leaf.field {
-            MaybeVoid::Some(_) => quote!(#name::#ident),
-            MaybeVoid::Void => quote!(|()| #name::#ident),
-        };
-
-        match &leaf.callback {
-            Some(Callback::Label(callback)) => quote! {
-                #bump
-                #callback(lex).construct(#constructor, lex);
-            },
-            Some(Callback::Inline(inline)) => {
-                let arg = &inline.arg;
-                let body = &inline.body;
-
-                #[cfg(not(rust_1_82))]
-                let ret = quote!(impl CallbackResult<'s, #ty, #this>);
-
-                #[cfg(rust_1_82)]
-                let ret = quote!(impl CallbackResult<'s, #ty, #this> + use<'s>);
-
-                quote! {
-                    #bump
-
-                    #[inline]
-                    fn callback<'s>(#arg: &mut Lexer<'s>) -> #ret {
-                        #body
-                    }
-
-                    callback(lex).construct(#constructor, lex);
-                }
-            }
-            Some(Callback::Skip(_)) => {
-                quote! {
-                    #bump
-
-                    lex.trivia();
-                    #name::lex(lex);
-                }
-            }
-            None if matches!(leaf.field, MaybeVoid::Void) => quote! {
-                #bump
-                lex.set(Ok(#name::#ident));
-            },
-            None => quote! {
-                #bump
-                let token = #name::#ident(lex.slice());
-                lex.set(Ok(token));
-            },
-        }
-    }
-}