[VibeSWE]

Description

Malformed request headers and scalar JSON sent with a recognized log source can panic a worker instead of returning an error. Return HTTP 400 for malformed input, retain 401 for missing or incorrect cluster credentials, and return a generic 500 for invalid stored/generated forwarding headers.

• Make tenant extraction fallible and propagate errors through all 95 callers and their response wrappers.
• Harden stream authorization, ingestion, stream configuration, cluster-secret parsing, and forwarding header construction. Validate forwarding data before stream mutation.
• Preserve JSON error envelopes for PromQL, traces, dashboard preview, tool calls, and the OTel generator.
• Propagate header-build failures through RBAC, role, API-key, and OIDC sync callers, including mixed-node failures; preserve ordinary delivery-failure behavior.
• Clean up API-key and cluster sessions on failure and cancellation, including futures dropped before their first poll.
• Add regression tests and a property test over accepted header bytes.

Validation

• Backend-only library suite: 1,147 passed, 2 ignored.
• cargo clippy --all-targets --locked --offline: passed with existing warnings in unchanged code.
• Rust formatting and git diff --check: passed.
• Cargo commands ran serially with P_BUILD_NO_UI=1 and CARGO_BUILD_JOBS=4.

---

This PR has:

• been tested to ensure log ingestion and log query works against a running deployment.
• added comments explaining the intent where it would not be obvious.
• added documentation for new or modified features or behaviors.

The gRPC cookie parser and unrelated stored-state panic paths remain outside this change.