Function firehose_router 

pub fn firehose_router(
    service: Arc<WebIngestionService>,
    auth_provider: Option<Arc<dyn AuthProvider>>,
) -> Router

Builds the Firehose sub-router: route + service extension + optional Firehose-auth layer + shared ingestion body limits (gzip + 20 MiB wire / 300 MiB decompressed).

Deliberately not merged into protected_app — it must not sit under the global Bearer auth_middleware, since Firehose can only send its credential via X-Amz-Firehose-Access-Key. Auth is applied only when auth_provider is Some, matching every other ingestion route’s dev-mode-open behavior.