fix(openapi): harden story 2.1 production lifecycle

apps/admin-api/src/service.rs

@@ -74,7 +74,7 @@ pub struct AdminService {
 pub struct AdminServiceBuilder {
     registry: PostgresRegistry,
     storage_root: PathBuf,
-    artifact_store: Option<ArtifactStore>,
+    artifact_store: Option<Arc<ArtifactStore>>,
     auth_settings: AuthSettings,
     secret_crypto: SecretCrypto,
     runtime: RuntimeExecutor,
@@ -88,6 +88,18 @@ pub struct AdminServiceBuilder {
 
 pub use crate::dto::*;
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ReadinessChecks {
+    pub postgres: bool,
+    pub artifact_storage: bool,
+}
+
+impl ReadinessChecks {
+    pub const fn is_ready(self) -> bool {
+        self.postgres && self.artifact_storage
+    }
+}
+
 #[derive(Clone, Debug)]
 pub struct AdminAuditContext {
     actor: AuditActor,
@@ -124,9 +136,16 @@ pub(super) struct CredentialAuditRecord<'a> {
 }
 
 impl AdminService {
-    pub async fn readiness(&self) -> Result<(), ApiError> {
-        self.registry.ping().await?;
-        Ok(())
+    pub async fn readiness(&self) -> ReadinessChecks {
+        let postgres = self.registry.ping().await.is_ok();
+        let store = Arc::clone(&self.artifact_store);
+        let artifact_storage = tokio::task::spawn_blocking(move || store.check_health())
+            .await
+            .is_ok_and(|result| result.is_ok());
+        ReadinessChecks {
+            postgres,
+            artifact_storage,
+        }
     }
 
     #[cfg(test)]
@@ -230,7 +249,7 @@ impl AdminServiceBuilder {
     /// Reuses the process-wide immutable artifact authority for OpenAPI
     /// ingress and reconciliation. Tests may omit this and use their private
     /// storage root instead.
-    pub fn with_artifact_store(mut self, artifact_store: ArtifactStore) -> Self {
+    pub fn with_artifact_store(mut self, artifact_store: Arc<ArtifactStore>) -> Self {
         self.artifact_store = Some(artifact_store);
         self
     }
@@ -264,10 +283,9 @@ impl AdminServiceBuilder {
     pub fn build(self) -> AdminService {
         AdminService {
             registry: self.registry,
-            artifact_store: Arc::new(
-                self.artifact_store
-                    .unwrap_or_else(|| ArtifactStore::new(&self.storage_root)),
-            ),
+            artifact_store: self
+                .artifact_store
+                .unwrap_or_else(|| Arc::new(ArtifactStore::new(&self.storage_root))),
             runtime: self.runtime,
             storage: LocalArtifactStorage::new(self.storage_root),
             auth_settings: self.auth_settings,