Phase 5: hardening — gRPC, observability, auth, config

- proto: lakehouse.proto with CatalogService, QueryService, StorageService, AiService
- proto crate: tonic-build codegen from proto definitions
- catalogd: gRPC CatalogService implementation
- gateway: dual HTTP (:3100) + gRPC (:3101) servers
- gateway: OpenTelemetry tracing with stdout exporter
- gateway: API key auth middleware (toggleable)
- shared: TOML config system with typed structs and defaults
- lakehouse.toml config file
- ADR-006 and ADR-007 documented

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lakehouse.toml

@@ -0,0 +1,33 @@
+# Lakehouse Configuration
+
+[gateway]
+host = "0.0.0.0"
+port = 3100
+
+[storage]
+root = "./data"
+# backend = "local"  # local | s3 | rustfs
+
+[catalog]
+# Manifests persisted to object storage under this prefix
+manifest_prefix = "_catalog/manifests"
+
+[query]
+# max_rows_per_query = 10000
+
+[sidecar]
+url = "http://localhost:3200"
+
+[ai]
+embed_model = "nomic-embed-text"
+gen_model = "qwen2.5"
+rerank_model = "qwen2.5"
+
+[auth]
+enabled = false
+# api_key = "changeme"
+
+[observability]
+# Export traces to stdout (set to "otlp" for OpenTelemetry collector)
+exporter = "stdout"
+service_name = "lakehouse"