feat(backend): enable GCS backend (multistore gcp + wasm-compatible signing)

[alukach]

What

Enables the Google Cloud Storage backend in the data proxy so source.coop data connections with provider: "gcs" resolve to a real storage client instead of erroring.

Changes (Cargo.toml / Cargo.lock only)

1. gcp feature on multistore and multistore-cf-workers → BackendType::Gcs builds a GoogleCloudStorageBuilder instead of returning ConfigError("GCS backend support not enabled").
2. ring wasm32_unknown_unknown_js feature (via a direct wasm-target entry): object_store's GCS credential module signs JWTs with ring::rand::SystemRandom, whose SecureRandom impl on wasm32-unknown-unknown is gated behind that ring feature (enables getrandom 0.2's js backend). Without it the Workers build fails to compile:

   error[E0277]: the trait bound `SystemRandom: SecureRandom` is not satisfied
     --> object_store-0.13.2/src/gcp/credential.rs
   

   ring is transitive (via object_store); this only turns the feature on for the wasm target.

Runtime note

source.coop uses keyless Workload Identity Federation for GCS, so the RSA private-key signing path isn't exercised at runtime — but the code must compile, which this enables. (getrandom's js backend maps to Web Crypto, which the Workers runtime provides, so it's also safe if ever hit.)

Pairs with

source-cooperative/source.coop#453 — aligns the persisted provider value to "gcs" (the string this backend accepts).

Verification

cargo check + cargo clippy -D warnings + cargo fmt --check for wasm32-unknown-unknown, and the full cargo test suite — all pass.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 51s —— View job

---

Review of PR #191

✅ No blocking issues — safe to merge.

• The change is scoped purely to Cargo.toml/Cargo.lock — no application logic changes in this repo, so there's no business-logic to break.
• Cargo.toml:69 — ring is correctly declared only under [target.'cfg(target_arch = "wasm32")'.dependencies], so the added wasm32_unknown_unknown_js feature is scoped to the wasm target and won't affect the native cargo test build.
• Cargo.lock resolves ring to 0.17.14, which satisfies the new "0.17" requirement — consistent with the version already pulled in transitively via object_store, so no version conflict.
• gcp feature is added consistently to both multistore (native, Cargo.toml:38) and multistore-cf-workers (wasm, Cargo.toml:70), matching the existing azure feature pattern.
• The security note in the PR body (keyless Workload Identity Federation means the RSA-signing/SystemRandom path isn't exercised at runtime, and getrandom's js backend maps to Web Crypto if it ever is) is accurate and reduces risk of the newly-enabled ring wasm path.
• src/source_api/registry.rs:287 already normalizes "gcs"/"gs" provider strings, so this feature flag change is what's needed to make that path actually resolve to a real backend — consistent with the stated goal.

No correctness, security, or best-practice issues found.

[github-actions]

🚀 Latest commit deployed to https://source-data-proxy-pr-191.source-coop.workers.dev

• Date: 2026-07-22T18:37:52Z
• Commit: 66b5273