feat(openapi): complete upload preview and UI evidence

apps/admin-api/src/service.rs

@@ -3,6 +3,7 @@ use std::path::PathBuf;
 use std::sync::Arc;
 
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use crank_artifacts::ArtifactStore;
 use crank_core::{
     AuditActor, AuditEvent, AuditEventId, AuditSink, AuditTarget, AuditTargetKind, AuthProfile,
     CapabilityProfile, CommunityCapabilityProfile, CorrelationContext, EditionCapabilities,
@@ -57,6 +58,7 @@ use operation_validation::{
 #[derive(Clone)]
 pub struct AdminService {
     registry: PostgresRegistry,
+    artifact_store: Arc<ArtifactStore>,
     runtime: RuntimeExecutor,
     storage: LocalArtifactStorage,
     auth_settings: AuthSettings,
@@ -72,6 +74,7 @@ pub struct AdminService {
 pub struct AdminServiceBuilder {
     registry: PostgresRegistry,
     storage_root: PathBuf,
+    artifact_store: Option<ArtifactStore>,
     auth_settings: AuthSettings,
     secret_crypto: SecretCrypto,
     runtime: RuntimeExecutor,
@@ -201,6 +204,7 @@ impl AdminServiceBuilder {
         Self {
             registry,
             storage_root,
+            artifact_store: None,
             auth_settings,
             secret_crypto,
             runtime,
@@ -223,6 +227,14 @@ impl AdminServiceBuilder {
         self
     }
 
+    /// Reuses the process-wide immutable artifact authority for OpenAPI
+    /// ingress and reconciliation. Tests may omit this and use their private
+    /// storage root instead.
+    pub fn with_artifact_store(mut self, artifact_store: ArtifactStore) -> Self {
+        self.artifact_store = Some(artifact_store);
+        self
+    }
+
     pub fn with_public_base_url(mut self, public_base_url: String) -> Self {
         self.public_base_url = public_base_url.trim_end_matches('/').to_owned();
         self
@@ -252,6 +264,10 @@ impl AdminServiceBuilder {
     pub fn build(self) -> AdminService {
         AdminService {
             registry: self.registry,
+            artifact_store: Arc::new(
+                self.artifact_store
+                    .unwrap_or_else(|| ArtifactStore::new(&self.storage_root)),
+            ),
             runtime: self.runtime,
             storage: LocalArtifactStorage::new(self.storage_root),
             auth_settings: self.auth_settings,