feat(cache): expose native Blob Cache over tenant-scoped HTTP

.changeset/remote-native-blob-cache.md

@@ -0,0 +1,7 @@
+---
+"@reddb-io/cli": minor
+"@reddb-io/client": minor
+"@reddb-io/sdk": minor
+---
+
+Expose the native Blob Cache over authenticated HTTP with tenant-scoped namespaces, hard TTL, binary values, existence probes and key/prefix/tag/namespace invalidation. The remote JavaScript client now uses application-authorized endpoints for tag invalidation and namespace flush, without requiring an operator credential. Align cache policy types with the implemented HTTP contract.

.github/workflows/ci.yml

@@ -211,6 +211,13 @@ jobs:
           fi
       - name: Build RedWire server
         run: cargo build --locked --bin red
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: '22'
+      - name: Remote HTTP native Blob Cache regression
+        env:
+          RED_BIN: ${{ github.workspace }}/target/debug/red
+        run: node scripts/test-remote-cache.mjs
       - name: Run Rust driver conformance over RedWire
         env:
           RED_BIN: ${{ github.workspace }}/target/debug/red

crates/reddb-server/Cargo.toml

@@ -32,6 +32,7 @@ reddb-file = { workspace = true }
 reddb-crypto = { workspace = true }
 aes-gcm = "0.11"
 blake3 = "1"
+base64 = "0.22"
 # SIMD/PCLMULQDQ CRC32 (IEEE 802.3 polynomial) for WAL/page record
 # checksums (issue #883 / PRD #882). Runtime CPU feature detection
 # selects the pclmulqdq path with a table-based scalar fallback —

crates/reddb-server/src/auth/action_catalog.rs

@@ -157,6 +157,24 @@ pub struct ActionEntry {
 /// delete the row. To remove one: change it to `Removed` (and only
 /// delete after a release cycle).
 pub const ACTIONS: &[ActionEntry] = &[
+    ActionEntry {
+        name: "cache:read",
+        category: ActionCategory::Other,
+        lifecycle_state: LifecycleState::Active,
+        gates_description: "read or probe a native Blob Cache namespace",
+    },
+    ActionEntry {
+        name: "cache:write",
+        category: ActionCategory::Other,
+        lifecycle_state: LifecycleState::Active,
+        gates_description: "write values to a native Blob Cache namespace",
+    },
+    ActionEntry {
+        name: "cache:invalidate",
+        category: ActionCategory::Other,
+        lifecycle_state: LifecycleState::Active,
+        gates_description: "invalidate or flush a native Blob Cache namespace",
+    },
     // -- DML / DDL / privilege management --------------------------------
     ActionEntry {
         name: "select",

crates/reddb-server/src/server.rs

@@ -115,6 +115,7 @@ mod handlers_ai_model_cache;
 pub(crate) mod handlers_auth;
 mod handlers_backup;
 mod handlers_browser_auth;
+mod handlers_cache;
 mod handlers_capabilities;
 mod handlers_collection_policy;
 mod handlers_ec;