feat: add admin route policy inventory (#3286)

* feat: add admin route policy inventory

* fix: align table route policy actions

* fix: align load table route policy action

docs/architecture/migration-progress.md

@@ -5,15 +5,17 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
 ## Current Context
 
 - Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660)
-- Branch: `overtrue/arch-security-governance-policy-types`
-- Baseline: `upstream/main` at `7a9bf707ee66e779f85e6e00cedfaa10ec2af4c2`
+- Branch: `overtrue/arch-admin-route-policy`
+- Baseline: `origin/main` at `3d0e6ce0da93de0f4618beb194ae2241df71f344`
 - PR type for this branch: `contract`
 - Runtime behavior changes: none
-- Rust code changes: add redaction, serde policy, and artifact integrity
-  contract modules to the pure rustfs-security-governance crate, with typed
-  validation errors and unit tests.
+- Rust code changes: add `rustfs/src/admin/route_policy.rs` as a pure
+  admin-route policy inventory backed by `rustfs-security-governance` route
+  contract types, with explicit deferred entries for routes that need
+  contextual, S3-action, multi-action, credential-only, or not-implemented
+  contract support.
 - CI/script changes: none
-- Docs changes: record the Phase 1 policy contract handoff.
+- Docs changes: record the S-006 route policy handoff.
 
 ## Phase 0 Tasks
 
@@ -88,52 +90,57 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block
     errors model digest, signature, and provenance requirements without changing
     release or CI behavior.
   - Verification: `cargo test -p rustfs-security-governance`.
-- [ ] `S-006` Add `rustfs/src/admin/route_policy.rs` backed by these contract
+- [x] `S-006` Add `rustfs/src/admin/route_policy.rs` backed by these contract
   types, without changing route registration or auth behavior.
+  - Acceptance: direct `AdminRouteSpec` entries cover routes with a single
+    stable admin policy action, deferred inventory records routes that need
+    richer contract support, and tests prove the combined inventory covers every
+    registered admin route.
 
 ## Next PRs
 
-1. `contract`: add an admin route policy table that consumes the new admin
-   route matrix types while preserving route registration and auth behavior.
-2. `contract`: add initial policy inventory tables for redaction, serde, or
+1. `contract`: add initial policy inventory tables for redaction, serde, or
    supply-chain governance only after the contract shape remains stable.
 
 ## Pre-Push Review Log
 
 | Expert | Status | Notes |
 |---|---|---|
-| Quality/architecture | pass | Confirmed the staged diff includes the new modules, keeps a pure `contract` design, uses clear API names and typed errors, and does not introduce runtime/admin/router/auth/startup/storage/config/global-state integration |
-| Migration preservation | pass | Confirmed this PR only completes `S-003` through `S-005`, does not shift away from backlog #660, does not touch storage hot paths or global-state migration, and does not need compatibility markers |
-| Testing/verification | pass | Confirmed focused contract tests assert valid and invalid policy behavior, production logic was not changed to satisfy tests, focused checks passed, and full `make pre-commit` passed |
+| Quality/architecture | pass | Pure contract inventory module; no runtime route registration, alias canonicalization, or handler auth mutation. Names and deferred reasons are explicit and avoid false policy precision. |
+| Migration preservation | pass | Aligns with backlog #660: directory and contract boundary first, no global-state migration, no crate split, and no storage hot-path behavior drift. |
+| Testing/verification | pass | Route-policy tests cover validation, public exceptions, table-catalog scope, deferred contextual routes, and every registered admin route. Focused checks, guard scripts, and full pre-commit pass. |
 
 ## Verification Notes
 
 Passed:
-- `cargo check -p rustfs-security-governance`
-- `cargo test -p rustfs-security-governance`
+- `cargo test -p rustfs admin::route_policy`
+- `cargo fmt --all`
 - `cargo fmt --all --check`
-- `cargo tree -p rustfs-security-governance --edges normal`
+- `cargo check -p rustfs`
 - `./scripts/check_architecture_migration_rules.sh`
-- `./scripts/check_layer_dependencies.sh`
 - `./scripts/check_metrics_migration_refs.sh`
+- `./scripts/check_layer_dependencies.sh`
 - `git diff --check`
+- Rust quality scans for production `unwrap`/`expect`, narrowing casts,
+  string errors, boxed dynamic errors, debug printing, and relaxed atomics in
+  `rustfs/src/admin/route_policy.rs`
 - `make pre-commit`
 
 Notes:
-- `cargo test -p rustfs-security-governance` passed 20 unit tests.
-- `make pre-commit` passed, including 5513 nextest tests, 105 skipped tests,
-  and workspace doctests.
+- `cargo test -p rustfs admin::route_policy` passed 7 route-policy tests.
+- `make pre-commit` passed all checks, including 5526 nextest tests and
+  workspace doctests.
 
 ## Handoff Notes
 
-- Keep this Phase 1 branch as a pure `contract` PR. Do not add
-  `rustfs/src/admin` integration, route registration changes, auth enforcement,
-  Config moves, Storage API moves, Runtime moves, or ECStore moves.
-- The new crate is allowed to depend on generic Rust libraries such as
-  `thiserror`, but must stay independent from implementation crates and runtime
-  state.
+- Keep this S-006 branch as a pure `contract` PR. Do not change
+  admin route registration, `/minio/admin` alias canonicalization, handler auth
+  enforcement, Config moves, Storage API moves, Runtime moves, or ECStore moves.
+- `rustfs` may depend on `rustfs-security-governance` for contract metadata;
+  the security-governance crate must stay independent from implementation
+  crates and runtime state.
 - Do not add temporary compatibility code without a matching
   `RUSTFS_COMPAT_TODO(<task-id>)` marker and cleanup-register entry.
-- The next admin route policy PR may consume the contract types, but must
-  preserve current route registration, alias canonicalization, public
-  exceptions, and handler-level authorization behavior.
+- Deferred route policy entries must remain explicit until the contract crate
+  gains richer support for contextual owner checks, S3 actions, multiple
+  accepted actions, credential-only gates, and not-implemented routes.