Phase 5: hardening — gRPC, observability, auth, config

- proto: lakehouse.proto with CatalogService, QueryService, StorageService, AiService
- proto crate: tonic-build codegen from proto definitions
- catalogd: gRPC CatalogService implementation
- gateway: dual HTTP (:3100) + gRPC (:3101) servers
- gateway: OpenTelemetry tracing with stdout exporter
- gateway: API key auth middleware (toggleable)
- shared: TOML config system with typed structs and defaults
- lakehouse.toml config file
- ADR-006 and ADR-007 documented

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Cargo.toml

@@ -2,6 +2,7 @@
 resolver = "2"
 members = [
     "crates/shared",
+    "crates/proto",
     "crates/storaged",
     "crates/catalogd",
     "crates/queryd",
@@ -29,3 +30,11 @@ bytes = "1"
 futures = "0.3"
 sha2 = "0.10"
 url = "2"
+tonic = "0.13"
+prost = "0.13"
+tonic-build = "0.13"
+opentelemetry = "0.28"
+opentelemetry_sdk = { version = "0.28", features = ["rt-tokio"] }
+opentelemetry-stdout = { version = "0.28", features = ["trace"] }
+tracing-opentelemetry = "0.29"
+toml = "0.8"