refactor(server-macros): emit fixed AUTH_METADATA const per service

The previous trait-derived const name turned `OpenShell` into
`OPEN_SHELL_AUTH_METADATA`, splitting the project name across an
underscore. Each impl already lives in its own module
(`crate::grpc::`, `crate::inference::`), so the module path is enough
to disambiguate between services — a fixed `AUTH_METADATA` name reads
more naturally.

Aggregator in `auth/method_authz.rs` now references
`crate::grpc::AUTH_METADATA` and `crate::inference::AUTH_METADATA`
directly.

Addresses review comment on PR #1596.

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Author: mrunalp

crates/openshell-server-macros/src/lib.rs

@@ -196,19 +196,12 @@ fn snake_to_pascal(ident: &str) -> String {
     out
 }
 
-/// `OpenShell` → `OPEN_SHELL_AUTH_METADATA`.
-fn const_ident_from_trait(trait_ident: &Ident) -> Ident {
-    let name = trait_ident.to_string();
-    let mut buf = String::with_capacity(name.len() * 2);
-    for (i, c) in name.chars().enumerate() {
-        if c.is_ascii_uppercase() && i != 0 {
-            buf.push('_');
-        }
-        buf.extend(c.to_uppercase());
-    }
-    buf.push_str("_AUTH_METADATA");
-    Ident::new(&buf, trait_ident.span())
-}
+/// Name of the per-service const emitted alongside the impl block. The
+/// service module is what disambiguates between services — every impl
+/// lives in its own module (`crate::grpc::AUTH_METADATA`,
+/// `crate::inference::AUTH_METADATA`), so a fixed name reads more
+/// naturally than `OPEN_SHELL_AUTH_METADATA` / `INFERENCE_AUTH_METADATA`.
+const AUTH_METADATA_CONST: &str = "AUTH_METADATA";
 
 fn trait_ident(item: &ItemImpl) -> Result<Ident> {
     let (_, path, _) = item.trait_.as_ref().ok_or_else(|| {
@@ -235,8 +228,10 @@ pub fn rpc_authz(args: TokenStream, item: TokenStream) -> TokenStream {
 }
 
 fn expand(args: &AuthzArgs, item: &mut ItemImpl) -> Result<proc_macro2::TokenStream> {
+    // `trait_ident` is still called for its validation side effect: the
+    // macro must be applied to a trait impl (`impl Trait for Type`).
     let trait_ident = trait_ident(item)?;
-    let const_name = const_ident_from_trait(&trait_ident);
+    let const_name = Ident::new(AUTH_METADATA_CONST, trait_ident.span());
     let service = args.service.value();
 
     let mut entries: Vec<proc_macro2::TokenStream> = Vec::new();

crates/openshell-server/src/auth/method_authz.rs

@@ -9,9 +9,6 @@
 //! consumed by `authz.rs` (role/scope), `oidc.rs` (unauthenticated
 //! check), and `sandbox_methods.rs` (sandbox principal allowlist).
 
-use crate::grpc::OPEN_SHELL_AUTH_METADATA;
-use crate::inference::INFERENCE_AUTH_METADATA;
-
 /// Per-method auth metadata emitted by `#[rpc_authz]`.
 ///
 /// Built at compile time and looked up at request-dispatch time.
@@ -54,8 +51,10 @@ pub enum Role {
 
 /// All per-service auth tables in one flat list.
 ///
-/// Add a new service by appending its generated const here.
-const SERVICES: &[&[MethodAuth]] = &[OPEN_SHELL_AUTH_METADATA, INFERENCE_AUTH_METADATA];
+/// Add a new service by appending its module's `AUTH_METADATA` const here.
+/// The constant name is fixed by `#[rpc_authz]`; service disambiguation
+/// comes from the module path.
+const SERVICES: &[&[MethodAuth]] = &[crate::grpc::AUTH_METADATA, crate::inference::AUTH_METADATA];
 
 /// Find the auth metadata for `method`, if any.
 #[must_use]