auth: implement CloudFront signed-cookie minting for ambient Zarr access

[hweej]

Goal

Let a user authenticate once and have all subsequent Zarr chunk fetches to CloudFront carry auth ambiently — no per-request credential passing, with the BFF never in the data path. CloudFront validates signed cookies cryptographically at the edge, which matters because zarrstore fires hundreds of concurrent chunk requests.

Design is already specced in docs/plans/auth-architecture-bff-cloudfront-signed-cookies.md (BFF + CloudFront Signed Cookies): cookie scoped to .cbioportal.org; SameSite=None; Secure works across the BFF (cell-explorer.cbioportal.org) and CloudFront (cbioportal-public-imaging.assets.cbioportal.org); zarrstore just uses credentials: 'include'.

Current state

Scaffolding exists, signing is a stub:

• DatasourceType.S3_CLOUDFRONT — db/models.py
• mint_credentials() dispatch → _mint_cloudfront() — services/credentials.py:90
• wired into routes/datasets.py (credentials endpoint) and services/chat_session.py
• the Keycloak user-session cookies (cce_access / cce_refresh) are implemented in routes/auth.py — this issue is specifically the CloudFront data-access cookie

_mint_cloudfront() validates the key-pair env vars exist, then returns placeholders:

"cookies": {
    "CloudFront-Policy": "TODO",
    "CloudFront-Signature": "TODO",
    "CloudFront-Key-Pair-Id": key_pair_id,
}

Remaining work

• Implement real CloudFront signed-cookie generation in _mint_cloudfront (RSA signing via boto3.CloudFrontSigner / cryptography) using DATASOURCE_{ref}_KEY_PAIR_ID + DATASOURCE_{ref}_PRIVATE_KEY
• Set the CloudFront-Policy / CloudFront-Signature / CloudFront-Key-Pair-Id as ambient Set-Cookie headers scoped to .cbioportal.org; SameSite=None; Secure (rather than returning them in a JSON body)
• Frontend: ensure zarrstore fetches with credentials: 'include' for s3_cloudfront datasources
• Infra (cell-explorer-infra): CloudFront key group (private key on BFF, public key registered in CloudFront) + distribution configured to require signed cookies on the Zarr paths
• Integration test against a real CloudFront distribution

Refs: docs/plans/auth-architecture-bff-cloudfront-signed-cookies.md, docs/architecture.md (datasource credential resolution).