feat: Add RustFS artifact object store and migration tool

- Implemented RustFsArtifactObjectStore for managing artifacts in RustFS.
- Added unit tests for RustFsArtifactObjectStore functionality.
- Created a RustFS migrator tool to transfer objects from S3 to RustFS.
- Introduced policy preview and report models for API integration.
- Added fixtures and tests for policy preview and report functionality.
- Included necessary metadata and scripts for cache_pkg package.

docs/ARCHITECTURE_AUTHORITY.md

@@ -99,6 +99,8 @@ plan?        = <plan name>              // optional hint for UIs; not used for e
   * **Client Credentials** (service→service):
 
     * **mTLS**: mutual TLS + `client_id` → bound token (`cnf.x5t#S256`)
+      * `security.senderConstraints.mtls.enforceForAudiences` forces the mTLS path when requested `aud`/`resource` values intersect high-value audiences (defaults include `signer`). Authority rejects clients attempting to use DPoP/basic secrets for these audiences.
+      * Stored `certificateBindings` are authoritative: thumbprint, subject, issuer, serial number, and SAN values are matched against the presented certificate, with rotation grace applied to activation windows. Failures surface deterministic error codes (e.g. `certificate_binding_subject_mismatch`).
     * **private_key_jwt**: JWT‑based client auth + **DPoP** header (preferred for tools and CLI)
   * **Device Code** (CLI): `POST /oauth/device/code` + `POST /oauth/token` poll
   * **Authorization Code + PKCE** (UI): standard