Remove pg_featureserv

[oskarhurst]

Removes pg_featureserv and the /features proxy from this repo.

Why

It was exposed without authentication. In api/main.go the route was registered on the
root router, not under the authenticated api group:

features := e.Group("/features")                       // <- on e, not on api
features.Use(middleware.PgFeatureservProxy(cfg.PgFeatureservUrl))

JWT and key auth are attached to private := api.Group(""), so neither applied here. Every
request to /features/* was proxied straight through to pg_featureserv.

No consumer could be found. Searched three codebases:

Codebase	Result
cumulus-ui	no reference to /features, featureserv, collections or ogc. Requests are all built from VITE_CUMULUS_API_URL (.../api), and /features is a sibling of /api, so the UI cannot reach it. Spatial data comes from /watersheds and /user-regions, rendered with Leaflet.
hec-rts	no reference across 12,476 files. The CAVI Cumulus importer (usace/cavi/client/extract/cumulus) uses /products, /watersheds and /downloads over the authenticated /api routes.
cumulus-api	only the proxy itself — nothing internal calls it.

Its CVEs cannot be fixed here. pg_featureserv/Dockerfile was
FROM ghcr.io/cwbi-apps/pg_featureserv:1.3.1-amd64 plus an entrypoint — a prebuilt binary
with no apt step, so neither a rebuild nor a dependency bump in this repo reaches it. 1.3.1
is the current upstream release from CrunchyData, so there is no newer version to move to, and
github.com/jackc/pgx/v4 has no fix on the v4 line at all (EOL; fixed only in v5).

Keeping it meant owning an unauthenticated, unpatchable service with no identified user.

Changes

File	Change
api/main.go	remove the /features group and proxy
api/middleware/proxy-pgfeatureserv.go	deleted
api/config/config.go	remove PgFeatureservUrl / PG_FEATURESERV_URL
api/middleware/gzip.go	drop the now-dead /features skip; keep the /cog/ byte-range skip
pg_featureserv/	deleted (Dockerfile, entrypoint.sh)
.github/workflows/cwbi-{dev,test,prod}-build-push-pg_featureserv.yml	deleted
docker-compose.yml	remove the featureserv service and PG_FEATURESERV_URL
docker-compose.tests.yml	remove PG_FEATURESERV_URL

Deliberately not changed

sql/common/R__01_roles.sql. It carries a comment saying the GRANT USAGE ON SCHEMA cumulus TO cumulus_reader was added "to make pg_featureserv work", but cumulus_reader is
not specific to this service: it is granted to cumulus_user (line 48) and used by
R__03_views_watersheds.sql and R__04_views_products.sql. Removing the grants would break
unrelated things.

The comment is now stale, but this is a Flyway repeatable migration — editing it changes
the checksum and re-runs it on the next deploy. Not worth triggering for a comment, so it is
left as-is. Happy to follow up separately if you would rather it be corrected.

Required follow-up outside this repo

Merging this stops the image being built. It does not stop the deployed service running,
so please treat these as part of the same change:

1. Deprovision the running pg_featureserv service and remove the /features route from
   the ALB / ingress. Until this happens the unauthenticated endpoint is still live.
2. Delete the cumulus-pg_featureserv ECR repository, or it will keep being scanned and
   keep generating CVE issues for an image nobody builds.

Related issues

Deliberately Refs, not Closes. The vulnerable service keeps running until step 1
above is done, and auto-closing 22 security issues on merge would mark live vulnerabilities as
resolved. Please close them by hand once deprovisioning is confirmed.

Fully resolved once deprovisioned — pg_featureserv is the only module on these:

Refs USACE/cumulus-issue-tracking#6, refs USACE/cumulus-issue-tracking#19, refs USACE/cumulus-issue-tracking#7, refs USACE/cumulus-issue-tracking#8, refs USACE/cumulus-issue-tracking#37, refs USACE/cumulus-issue-tracking#9, refs USACE/cumulus-issue-tracking#97

Issue	Severity	Package
USACE/cumulus-issue-tracking#6	CRITICAL	github.com/jackc/pgx/v4 — no fix on v4 at all
USACE/cumulus-issue-tracking#19	CRITICAL	github.com/getkin/kin-openapi — auth bypass
USACE/cumulus-issue-tracking#7	HIGH	github.com/getkin/kin-openapi
USACE/cumulus-issue-tracking#8	HIGH	github.com/jackc/pgproto3/v2
USACE/cumulus-issue-tracking#37	HIGH	libacl
USACE/cumulus-issue-tracking#9	MEDIUM	coreutils-single
USACE/cumulus-issue-tracking#97	MEDIUM	github.com/getkin/kin-openapi

Module set shrinks only — these also affect other modules and stay open:

Refs USACE/cumulus-issue-tracking#10, refs USACE/cumulus-issue-tracking#11, refs USACE/cumulus-issue-tracking#2, refs USACE/cumulus-issue-tracking#24, refs USACE/cumulus-issue-tracking#30, refs USACE/cumulus-issue-tracking#36, refs USACE/cumulus-issue-tracking#39, refs USACE/cumulus-issue-tracking#40, refs USACE/cumulus-issue-tracking#41, refs USACE/cumulus-issue-tracking#42, refs USACE/cumulus-issue-tracking#43, refs USACE/cumulus-issue-tracking#4, refs USACE/cumulus-issue-tracking#82, refs USACE/cumulus-issue-tracking#83, refs USACE/cumulus-issue-tracking#91

The next scan sync will drop pg_featureserv from their module labels automatically.

Testing

Not built, not run. Neither Go nor Docker is available on the machine this was prepared
on, so this is an inspection-only change. Gate on cwbi-test-build-push-api.

Checked by hand in place of a compiler: middleware is still used in main.go (41 other
references), strings is still used in gzip.go by the /cog/ skip, and no reference to
featureserv or PG_FEATURESERV_URL remains anywhere outside the SQL comment noted above.

If this is wrong

If someone is using /features — another CWBI app, a QGIS/ArcGIS layer pointed at the OGC
endpoint, or the pg_featureserv browse UI — this PR breaks them, and the search above would
not have found it. The route and the cumulus_reader grant were both added deliberately, so
it is worth a quick check with whoever added them before merging. Access logs on /features
would settle it faster than any code search.