Add DataPass pull poller (API-6754)

[Un3x]

Summary

• Periodic GoodJob cron pulls validated authorization_requests from DataPass and idempotently creates ProactiviteRequest rows.
• New layers under Datapass:: mirror the CNOUS layout: configuration value object, Faraday HTTP wrapper with TransientError/PermanentError translation, four interactors organized by Datapass::PullEnrollments, a single-row DatapassPullWatermark model, PullDatapassEnrollmentsJob, a datapass:pull rake + CLI for manual replay or external schedulers.
• The model's existing after_create_commit callback enqueues ProcessProactiviteRequestJob (no double-wiring), and the external_request_id column is renamed to datapass_authorization_id to reflect the now-single external source.
• Daily cron at 01:00 UTC (DATAPASS_PULL_CRON overridable). First run watermark is nil, so the backlog of currently-validated CNOUS authorizations gets ingested on deploy.
• Replaces functionally the cancelled webhook plan (API-6716).

Architecture

GoodJob cron (daily 01:00 UTC)
  └─> PullDatapassEnrollmentsJob#perform
        └─> Datapass::PullEnrollments  (organizer)
              ├─> Authenticate                  (OAuth2 client_credentials → bearer)
              ├─> ListValidatedAuthorizations   (paginate + filter on definition_id + last_validated_at >= since)
              ├─> CreateProactiviteRequests     (find_or_create_by datapass_authorization_id)
              └─> AdvanceWatermark              (last_validated_at = max(entries))

Decisions (see plan)

• Rename external_request_id → datapass_authorization_id (no second column).
• Separate DATAPASS_AUTH_URL and DATAPASS_API_BASE_URL env vars (mirror CNOUS).
• Fallback data['niveau_bourse_min'] || data['echelon_bourse'] for the scholarship-level mapping (DataPass field name unsettled).
• Daily cron 0 1 * * *; carve-out flagged if API-6726 / API-6750 mandates an external scheduler — rake datapass:pull + CLI already supports it.
• First-run watermark nil so the existing CNOUS habilitation backlog is ingested.
• Watermark advances past every entry the poller saw (incl. per-row validation failures, which Sentry-report instead of pinning the cycle).

Test plan

• bundle exec rspec — 169 examples / 0 failures
• bundle exec rubocop — 67 files / 0 offenses
• bundle exec brakeman — 0 warnings
• R-005 regression spec on Datapass::Authenticate proves the bearer token never reaches Rails.logger
• Replay safety: re-running the organizer with the same DataPass entries creates no duplicate rows and enqueues no duplicate jobs
• Failure paths: 5xx → TransientError → job retries; 4xx → PermanentError → job discards + Sentry; mid-pagination crash leaves the watermark untouched
• Real DataPass call — blocked on API-6753 (ops provisioning)

🤖 Generated with Claude Code