[BYO-S3] Backend: assume-role warehouse creation + reserve-identity

[mengw15]

Task Summary

Part of #6870. The backend for the AWS path, where the user grants an IAM role instead of
handing over long-lived access keys.

• Reserve an identity up front — a POST /warehouse/reserve-identity endpoint: the web service
  mints a per-warehouse, server-generated external_id (a random UUID; reuses the existing pending
  one if present) and returns it with the deployment's platform principal ARN, so the user can wire
  their IAM role's trust policy in one step, before the warehouse exists.
• Assume-role create — creating an AWS-flavor warehouse binds the reserved external ID and, via
  LakekeeperClient, registers a Lakekeeper warehouse whose storage profile carries
  assume-role-arn + sts-enabled, and whose storage credential is aws-system-identity with
  the external-id. Lakekeeper validates by actually assuming the role and test-writing to S3,
  so a wrong role ARN or external ID fails at create time (HTTP 502), before anything is saved.
• Platform identity config — a platform-role-arn setting (StorageConfig / storage.conf):
  the deployment's AWS identity ARN, shown to users so they know whom to trust in their role;
  empty when the deployment has no AWS identity.

Task Type

• Other (feature implementation)