Implements steps 1-2 and the RBAC half of step 4 of
docs/plan-storefront-edge-config.md (storefront auth gating, generalised
to dynamic grain routes).
- platform/edgeconfig: Fragment/Reloader interfaces, atomic Writer
(all-or-nothing flush), HTTPReloader (dev), NullReloader,
KubeReloader (injected PodLister keeps platform stdlib-only).
go vet clean; tests pass under -race.
- deploy/reloader-lib.sh + nginx-reloader.sh: reload handler
(cksum -> nginx -t -> graceful reload) + CGI endpoint on :8082
(pod IP only) + 60s fallback poll. Include-only risk model: main
config never changes at runtime; broken fragments fail validation
and the previous config keeps serving.
- k8s: reloader wired into the nginx Deployment, writable cms-output
mount, fragment include line, SA/Role/RoleBinding for backoffice
pod listing; backoffice uses the new ServiceAccount.
- compose/dev: same handler on stock nginx:alpine, EDGE_RELOAD_PROVIDER=http
targeting nginx:8082 from backoffice.
- docs: plan-storefront-edge-config.md (supersedes earlier gating plans)
and the fixed-zones variant kept for drift analysis.
