boost-backend: Add download proxy route for git-sourced AI assets

[rohitkrai03]

Problem

Context: RHIDP-15167 tasks 3.6-3.7. AdoptionCard links directly to GitHub zipball API for git assets. This fails for private repos. The spec requires a backend proxy using Backstage SCM integration credentials. PR #3747 deferred this.

Expected behavior

New route: GET /api/boost/catalog/download?entityRef=... that resolves entity via catalogApi, authenticates via @backstage/integration ScmIntegrations, streams ZIP archive back. Permission check via httpAuth + permissions.authorize(). Error handling: 403/404/502.

Scope

Workspace: workspaces/boost, Package: boost-backend

Files: plugins/boost-backend/src/routes/catalogDownload.ts (new handler), plugins/boost-backend/src/service/router.ts (register route), router.test.ts (tests)

Tests

1. Successful download (200), 2. Missing entity (404), 3. Missing location (404), 4. Permission denied (403), 5. Upstream error (502), 6. Unsupported host (400)

Notes

Only git downloads. OCI/MCP are frontend-only. Frontend follow-up to wire AdoptionCard to proxy is a separate issue.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 2:15 PM UTC · Completed 2:19 PM UTC
Commit: e649ae6 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Severity: Medium | Category: Feature

Problem

The AdoptionCard links directly to the GitHub zipball API for git-sourced assets, which fails for private repositories because browser requests lack SCM credentials. PR #3747 (now merged) deferred this backend proxy work.

Root Cause

Backstage SCM integration credentials are only available server-side via ScmIntegrations from @backstage/integration. A backend proxy route is needed to authenticate and stream ZIP archives to the client.

Recommended Approach

Create a new route handler at GET /api/boost/catalog/download?entityRef=... that:

1. Resolves the entity via catalogApi
2. Extracts the source location annotation
3. Uses ScmIntegrations to obtain authenticated credentials
4. Streams the ZIP archive from the upstream SCM provider
5. Enforces permissions via httpAuth + permissions.authorize()

Error handling: 403 (permission denied), 404 (missing entity/location), 502 (upstream failure), 400 (unsupported host).

Note: The existing boost-backend uses plugin.ts for route registration rather than service/router.ts — follow the existing pattern.

Proposed Test Cases

1. Successful download (200) — entity with valid git location, credentials resolved, ZIP streamed
2. Missing entity (404) — catalogApi returns no entity for entityRef
3. Missing location (404) — entity lacks source location annotation
4. Permission denied (403) — permissions.authorize() denies access
5. Upstream error (502) — upstream SCM returns an error
6. Unsupported host (400) — no SCM integration configured for the host

This issue is well-specified and ready for implementation.