feat(admin): add device credential isolation

admin/internal/evidence/evidence.go

@@ -5,8 +5,9 @@ import (
 	"context"
 	"errors"
 	"io"
-	"net/http"
 	"time"
+
+	"cmbuyer/admin/internal/deviceauth"
 )
 
 const (
@@ -25,23 +26,6 @@ var (
 	ErrTooLarge = errors.New("evidence file too large")
 )
 
-// DevicePrincipal is the already-authenticated device identity used only for audit and idempotency.
-type DevicePrincipal struct {
-	ID string
-}
-
-// DeviceAuthenticator deliberately has no token implementation in T-204. T-301 will supply one.
-type DeviceAuthenticator interface {
-	Authenticate(*http.Request) (DevicePrincipal, bool)
-}
-
-// RejectAllDeviceAuthenticator keeps the production upload route fail closed until T-301 wires credentials.
-type RejectAllDeviceAuthenticator struct{}
-
-func (RejectAllDeviceAuthenticator) Authenticate(*http.Request) (DevicePrincipal, bool) {
-	return DevicePrincipal{}, false
-}
-
 type UploadMetadata struct {
 	UploadKey   string
 	TaskID      string
@@ -83,6 +67,6 @@ type Asset struct {
 type Store interface {
 	Stage(io.Reader, string) (StagedFile, error)
 	Discard(StagedFile)
-	Commit(context.Context, DevicePrincipal, UploadMetadata, StagedFile) (Asset, bool, error)
+	Commit(context.Context, deviceauth.Principal, UploadMetadata, StagedFile) (Asset, bool, error)
 	Open(context.Context, string) (Asset, io.ReadSeekCloser, error)
 }