feat(sqs): broker-per-tenant multi-tenancy for AWS SQS (#3304)

[jeremydmiller]

Closes #3304

Brings AWS SQS up to parity with RabbitMQ / Azure Service Bus / NATS / Kafka on broker-per-tenant multi-tenancy. SQS already had named-broker support; this adds the missing runtime-routed, tenant-per-connection feature: each Wolverine tenant gets its own dedicated SQS connection (distinct AWS account/credentials, region, or ServiceURL) while sharing one queue topology, routed at runtime by Envelope.TenantId.

Approach

Mirrors the Azure Service Bus / Kafka tenant model. Each tenant owns a child AmazonSqsTransport with its own IAmazonSQS client and its own queue/QueueUrl cache — necessary because QueueUrl is cached per endpoint and would otherwise collide across tenants that share a queue name.

• AmazonSqsTenant (new): Compile(parent, runtime) seeds the child from the parent connection (credential source, region/ServiceURL, AuthenticationRegion, AutoProvision/AutoPurge, DLQ behavior) and then applies the tenant's own Configure overrides (seed-then-override, so a tenant re-points only the axes it sets). Note: AmazonSQSConfig.RegionEndpoint lazily resolves to an ambient default (never null) and is mutually exclusive with ServiceURL, both handled here.
• AmazonSqsTransport: LightweightCache<string, AmazonSqsTenant> Tenants; ConnectAsync compiles each tenant, builds its client, and (under AutoProvision) provisions the shared queues + DLQs on every tenant connection. Now implements IAsyncDisposable to dispose tenant (and its own) clients.
• AmazonSqsQueue: CreateSender returns a TenantedSender fanning out to per-tenant InlineSqsSenders; BuildListenerAsync returns a CompoundListener (shared listener + one per-tenant SqsListener wrapped in ReceiverWithRules + TenantIdRule). A BuildTenantSibling helper materializes the tenant's twin queue with copied config on the tenant transport. All guarded on Tenants.Any() && TenancyBehavior == TenantAware, so the non-tenant path is unchanged.

GH-2361 gotcha

Both the tenant senders and the default fallback are fire-and-forget InlineSqsSenders. TenantedSender intentionally does not implement ISenderRequiresCallback / forward RegisterCallback, so a BatchedSender/SqsSenderProtocol under it would silently drop every message. Same model as RabbitMQ / NATS / Kafka.

New public API (AmazonSqsTransportConfiguration)

TenantIdBehavior(TenantedIdBehavior behavior);
AddTenant(string tenantId, Action<AmazonSQSConfig> configure);               // dedicated region/endpoint
AddTenant(string tenantId, AWSCredentials credentials, Action<AmazonSQSConfig>? configure = null); // dedicated account

Tests

• 6 CI-safe unit tests (AmazonSqsPerTenantConfigurationTests, no broker): tenant registration, parent-seeding/override in Compile, credential inheritance vs. dedicated credentials, DLQ/region inheritance, tenant-aware-by-default, BuildTenantSibling isolation.
• 5 LocalStack integration tests (AmazonSqsPerTenantConnectionTests, skip-guarded when Docker/LocalStack is down): tenant message routes to the tenant connection and NOT the shared one; default message routes to the shared one; inbound tenant message is consumed and stamped with its TenantId; per-tenant queue provisioning; endpoint resolves a TenantedSender.

Caveat — LocalStack cannot prove separate accounts. LocalStack is a single container that does not enforce AWS account boundaries, so these tests cannot demonstrate account isolation. Tenant isolation is simulated with a distinct signing region (AuthenticationRegion) on the same endpoint — LocalStack partitions SQS queues per region, so the tenant's queue is genuinely a different physical queue — and the assertions verify message routing + Envelope.TenantId stamping, not physical broker separation.

Verification

• Wolverine.AmazonSqs.Tests: 215 passed, 6 skipped, 1 failed. The single failure (end_to_end_with_conventional_routing_with_prefix, a broker-init timeout with no tenants involved) reproduces identically on a clean tree without this change — a pre-existing LocalStack flake, not a regression.
• dotnet build wolverine.slnx -c Release: 0 warnings, 0 errors.

Docs

Added a "Multi-Tenancy with a Broker per Tenant" section under transports/sqs with a compiling mdsnippets sample sourced from Samples/Bootstrapping.cs.

🤖 Generated with Claude Code