feat(server): tenant-registry skeleton boots against dev stack

Minimal Go service so platform/portal has something to resolve in local
dev. Stdlib net/http with Go 1.22 enhanced ServeMux (method+path
patterns); no third-party deps yet.

Layout:
  cmd/server/main.go               entry point with graceful shutdown
  internal/config/                 env-driven config (APP_ENV, ADDR, KC issuer)
  internal/server/                 http handlers + request-logging middleware
  internal/store/memory.go         in-memory tenant store, seeded with acme
  migrations/0001_init.up.sql      schema for the M4.1 follow-up (unapplied)
  Makefile                         dev/test/build/lint/docker targets
  Dockerfile                       multi-stage distroless build

Endpoints (under :8080 in dev):
  GET /healthz
  GET /v1/tenants/by-slug/{slug}   200 acme | 404
  GET /v1/tenants/{id}             200 by uuid | 404

JWT validation and the real Postgres-backed store land in the M4.1
follow-up PR — keeping this PR strictly to 'boots, replies, tests pass'.

Refs: M4.1 (skeleton)

internal/config/config.go

@@ -0,0 +1,33 @@
+package config
+
+import (
+	"fmt"
+	"os"
+)
+
+type Config struct {
+	Env            string // dev | stage | prod
+	Addr           string // listen address, e.g. ":8080"
+	KeycloakIssuer string // e.g. http://localhost:8080/realms/breakpilot-dev
+	DatabaseURL    string // postgres DSN (unused in skeleton; in-memory store)
+}
+
+func Load() (*Config, error) {
+	env := getenv("APP_ENV", "dev")
+	if env != "dev" && env != "stage" && env != "prod" {
+		return nil, fmt.Errorf("invalid APP_ENV %q", env)
+	}
+	return &Config{
+		Env:            env,
+		Addr:           getenv("ADDR", ":8080"),
+		KeycloakIssuer: getenv("KEYCLOAK_ISSUER", "http://localhost:8080/realms/breakpilot-dev"),
+		DatabaseURL:    os.Getenv("DATABASE_URL"),
+	}, nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}

internal/server/server.go

@@ -0,0 +1,106 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"gitea.meghsakha.com/platform/tenant-registry/internal/config"
+	"gitea.meghsakha.com/platform/tenant-registry/internal/store"
+)
+
+type deps struct {
+	cfg    *config.Config
+	log    *slog.Logger
+	tenant *store.Memory
+}
+
+func NewRouter(cfg *config.Config, log *slog.Logger) http.Handler {
+	d := &deps{cfg: cfg, log: log, tenant: store.NewMemory()}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /healthz", d.healthz)
+	mux.HandleFunc("GET /v1/tenants/by-slug/{slug}", d.tenantBySlug)
+	mux.HandleFunc("GET /v1/tenants/{id}", d.tenantByID)
+
+	return logRequest(log)(mux)
+}
+
+func (d *deps) healthz(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+}
+
+func (d *deps) tenantBySlug(w http.ResponseWriter, r *http.Request) {
+	slug := r.PathValue("slug")
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+	defer cancel()
+
+	t, err := d.tenant.BySlug(ctx, slug)
+	if errors.Is(err, store.ErrNotFound) {
+		writeError(w, http.StatusNotFound, "tenant_not_found", "no tenant with that slug")
+		return
+	}
+	if err != nil {
+		d.log.Error("tenant lookup failed", "err", err)
+		writeError(w, http.StatusInternalServerError, "internal", "lookup failed")
+		return
+	}
+	writeJSON(w, http.StatusOK, t)
+}
+
+func (d *deps) tenantByID(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+	defer cancel()
+
+	t, err := d.tenant.ByID(ctx, id)
+	if errors.Is(err, store.ErrNotFound) {
+		writeError(w, http.StatusNotFound, "tenant_not_found", "no tenant with that id")
+		return
+	}
+	if err != nil {
+		d.log.Error("tenant lookup failed", "err", err)
+		writeError(w, http.StatusInternalServerError, "internal", "lookup failed")
+		return
+	}
+	writeJSON(w, http.StatusOK, t)
+}
+
+func writeJSON(w http.ResponseWriter, code int, body any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(body)
+}
+
+func writeError(w http.ResponseWriter, code int, kind, msg string) {
+	writeJSON(w, code, map[string]string{"error": kind, "message": msg})
+}
+
+func logRequest(log *slog.Logger) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			start := time.Now()
+			ww := &statusRecorder{ResponseWriter: w, code: 200}
+			next.ServeHTTP(ww, r)
+			log.Info("http",
+				"method", r.Method,
+				"path", r.URL.Path,
+				"status", ww.code,
+				"duration_ms", time.Since(start).Milliseconds(),
+			)
+		})
+	}
+}
+
+type statusRecorder struct {
+	http.ResponseWriter
+	code int
+}
+
+func (s *statusRecorder) WriteHeader(c int) {
+	s.code = c
+	s.ResponseWriter.WriteHeader(c)
+}

internal/server/server_test.go

@@ -0,0 +1,73 @@
+package server
+
+import (
+	"encoding/json"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"gitea.meghsakha.com/platform/tenant-registry/internal/config"
+)
+
+func newTestServer(t *testing.T) *httptest.Server {
+	t.Helper()
+	cfg := &config.Config{Env: "dev", Addr: ":0"}
+	h := NewRouter(cfg, slog.New(slog.NewTextHandler(os.Stderr, nil)))
+	return httptest.NewServer(h)
+}
+
+func TestHealthz(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/healthz")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("got %d, want 200", resp.StatusCode)
+	}
+}
+
+func TestTenantBySlug_acme(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/v1/tenants/by-slug/acme")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		t.Fatalf("got %d, want 200; body=%s", resp.StatusCode, body)
+	}
+	var payload map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload["slug"] != "acme" {
+		t.Fatalf("expected slug=acme, got %v", payload["slug"])
+	}
+	if payload["status"] != "active" {
+		t.Fatalf("expected status=active, got %v", payload["status"])
+	}
+}
+
+func TestTenantBySlug_unknown(t *testing.T) {
+	srv := newTestServer(t)
+	defer srv.Close()
+
+	resp, err := http.Get(srv.URL + "/v1/tenants/by-slug/nope")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("got %d, want 404", resp.StatusCode)
+	}
+}

internal/store/memory.go

@@ -0,0 +1,71 @@
+// Package store is a stand-in for the real Postgres-backed tenant store.
+// The skeleton ships an in-memory implementation pre-seeded with one tenant
+// (acme) so portal middleware has something to resolve in local dev.
+// Replace with a pgx-backed implementation in the M4.1 follow-up PR.
+package store
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"time"
+)
+
+var ErrNotFound = errors.New("tenant not found")
+
+type Tenant struct {
+	ID        string    `json:"id"`
+	Slug      string    `json:"slug"`
+	Name      string    `json:"name"`
+	Status    string    `json:"status"` // active | trial | frozen | archived | demo
+	Plan      string    `json:"plan"`   // starter | professional | enterprise
+	Products  []string  `json:"products"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+type Memory struct {
+	mu     sync.RWMutex
+	bySlug map[string]*Tenant
+	byID   map[string]*Tenant
+}
+
+func NewMemory() *Memory {
+	m := &Memory{
+		bySlug: make(map[string]*Tenant),
+		byID:   make(map[string]*Tenant),
+	}
+	seed := &Tenant{
+		ID:        "00000000-0000-0000-0000-000000000001",
+		Slug:      "acme",
+		Name:      "Acme Inc.",
+		Status:    "active",
+		Plan:      "professional",
+		Products:  []string{"certifai", "compliance"},
+		CreatedAt: time.Now().UTC(),
+	}
+	m.bySlug[seed.Slug] = seed
+	m.byID[seed.ID] = seed
+	return m
+}
+
+func (m *Memory) BySlug(_ context.Context, slug string) (*Tenant, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	t, ok := m.bySlug[slug]
+	if !ok {
+		return nil, ErrNotFound
+	}
+	cp := *t
+	return &cp, nil
+}
+
+func (m *Memory) ByID(_ context.Context, id string) (*Tenant, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	t, ok := m.byID[id]
+	if !ok {
+		return nil, ErrNotFound
+	}
+	cp := *t
+	return &cp, nil
+}