Phase 5: hardening — gRPC, observability, auth, config

- proto: lakehouse.proto with CatalogService, QueryService, StorageService, AiService
- proto crate: tonic-build codegen from proto definitions
- catalogd: gRPC CatalogService implementation
- gateway: dual HTTP (:3100) + gRPC (:3101) servers
- gateway: OpenTelemetry tracing with stdout exporter
- gateway: API key auth middleware (toggleable)
- shared: TOML config system with typed structs and defaults
- lakehouse.toml config file
- ADR-006 and ADR-007 documented

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/gateway/src/observability.rs

@@ -0,0 +1,37 @@
+use opentelemetry::trace::TracerProvider;
+use opentelemetry_sdk::trace::SdkTracerProvider;
+use tracing_opentelemetry::OpenTelemetryLayer;
+use tracing_subscriber::{EnvFilter, Registry, fmt, layer::SubscriberExt, util::SubscriberInitExt};
+
+/// Initialize tracing with optional OpenTelemetry export.
+pub fn init_tracing(service_name: &str, exporter: &str) {
+    let env_filter = EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| EnvFilter::new("info"));
+
+    match exporter {
+        "stdout" => {
+            // OTel traces to stdout + regular fmt layer
+            let provider = SdkTracerProvider::builder()
+                .with_simple_exporter(opentelemetry_stdout::SpanExporter::default())
+                .build();
+            let tracer = provider.tracer(service_name.to_string());
+
+            Registry::default()
+                .with(env_filter)
+                .with(fmt::layer())
+                .with(OpenTelemetryLayer::new(tracer))
+                .init();
+
+            tracing::info!("tracing initialized: fmt + opentelemetry-stdout");
+        }
+        _ => {
+            // Just fmt layer, no OTel
+            Registry::default()
+                .with(env_filter)
+                .with(fmt::layer())
+                .init();
+
+            tracing::info!("tracing initialized: fmt only");
+        }
+    }
+}