pub fn firehose_router(
service: Arc<WebIngestionService>,
auth_provider: Option<Arc<dyn AuthProvider>>,
) -> RouterExpand description
Builds the CloudWatch Logs Firehose sub-router: route + service extension + optional Firehose-auth layer + shared ingestion body limits (gzip + 20 MiB wire / 300 MiB decompressed).
Deliberately not merged into protected_app — same reasoning as the metrics Firehose
route: Firehose can only send its credential via X-Amz-Firehose-Access-Key, not
Authorization: Bearer. Auth is applied only when auth_provider is Some, matching
every other ingestion route’s dev-mode-open behavior.