feat: bucket inventory (part one); refactor 'api' package

* add ActCreateInventory control action (stub)
* create system's ais://.sys-inventory on very first (inventory) request
-------------
* refactor api/(bucket, multiobj) to reduce code
  - consolidate bucket-scoped requests via doBckAct()

Signed-off-by: Alex Aizman <alex.aizman@gmail.com>

Author: alex-aizman

ais/proxy.go

@@ -1614,6 +1614,18 @@ func (p *proxy) _bckpost(w http.ResponseWriter, r *http.Request, msg *apc.ActMsg
 			p.writeErr(w, r, err)
 			return
 		}
+	case apc.ActCreateInventory:
+		if err := p._sysInvBck(w, r, msg); err != nil {
+			return
+		}
+		cimsg := &apc.CreateInvMsg{}
+		if err := cos.MorphMarshal(msg.Value, cimsg); err != nil {
+			p.writeErrf(w, r, cmn.FmtErrMorphUnmarshal, p.si, msg.Action, msg.Value, err)
+			return
+		}
+		nlog.Errorf("%s: %+v", p, cimsg) // DEBUG
+		p.writeErr(w, r, cmn.NewErrNotImpl("create", "bucket inventory"), http.StatusNotImplemented)
+		return
 	default:
 		p.writeErrAct(w, r, msg.Action)
 		return
@@ -1623,6 +1635,20 @@ func (p *proxy) _bckpost(w http.ResponseWriter, r *http.Request, msg *apc.ActMsg
 	writeXid(w, xid)
 }
 
+func (p *proxy) _sysInvBck(w http.ResponseWriter, r *http.Request, msg *apc.ActMsg) error {
+	sys := &meta.Bck{Provider: apc.AIS, Name: cmn.SysInventoryName}
+
+	bctx := allocBctx()
+	bctx.p, bctx.w, bctx.r = p, w, r
+	bctx.bck = sys
+	bctx.msg = msg
+	bctx.createAIS = true
+	bctx.perms = apc.AceAdmin // (readability; will check admin access for reserved name)
+	_, err := bctx.initAndTry()
+	freeBctx(bctx)
+	return err
+}
+
 // init existing or create remote
 // not calling `initAndTry` - delegating ais:from// props cloning to the separate method
 func (p *proxy) initBckTo(w http.ResponseWriter, r *http.Request, query url.Values, bckTo *meta.Bck) (*meta.Bck, int, error) {

ais/prxauth.go

@@ -401,7 +401,7 @@ func (p *proxy) access(ctx context.Context, hdr http.Header, bck *meta.Bck, ace
 
 	// If auth is NOT enabled, only check bucket properties
 	if !cmn.Rom.AuthEnabled() {
-		if bck == nil {
+		if bck == nil || bck.Props == nil {
 			return nil
 		}
 		// With Auth disabled, always allow read-only access, PATCH, and ACL

api/apc/actmsg.go

@@ -1,6 +1,6 @@
 // Package apc: API constant and control messages
 /*
- * Copyright (c) 2018-2025, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2018-2026, NVIDIA CORPORATION. All rights reserved.
  */
 package apc
 
@@ -90,7 +90,7 @@ const (
 	ActEnableBackend  = "enable-bend"
 	ActDisableBackend = "disable-bend"
 
-	// Node maintenance & cluster membership (see also ActRmNodeUnsafe below)
+	// node maintenance & cluster membership (see also ActRmNodeUnsafe below)
 	ActStartMaintenance = "start-maintenance" // put into maintenance state
 	ActStopMaintenance  = "stop-maintenance"  // cancel maintenance state
 	ActShutdownNode     = "shutdown-node"     // shutdown node
@@ -112,8 +112,11 @@ const (
 	// advanced usage
 	ActCheckLock = "check-lock"
 
-	// Moss
+	// api/ml.go; x-moss
 	ActGetBatch = "get-batch"
+
+	// bucket inventory
+	ActCreateInventory = "create-inventory"
 )
 
 // internal use

api/apc/lsmsg.go

@@ -162,19 +162,26 @@ var (
 		GetPropsVersion, GetPropsCached, GetPropsStatus, GetPropsCopies, GetPropsEC, GetPropsCustom, GetPropsLocation}
 )
 
-// swagger:model
-type LsoMsg struct {
-	Header            http.Header `json:"hdr,omitempty"`         // (for pointers, see `ListArgs` in api/ls.go)
-	UUID              string      `json:"uuid"`                  // ID to identify a single multi-page request
-	Props             string      `json:"props"`                 // comma-delimited, e.g. "checksum,size,custom" (see GetProps* enum)
-	TimeFormat        string      `json:"time_format,omitempty"` // RFC822 is the default
-	Prefix            string      `json:"prefix"`                // return obj names starting with prefix (TODO: e.g. "A.tar/tutorials/")
-	StartAfter        string      `json:"start_after,omitempty"` // start listing after (AIS buckets only)
-	ContinuationToken string      `json:"continuation_token"`    // => LsoResult.ContinuationToken => LsoMsg.ContinuationToken
-	SID               string      `json:"target"`                // selected target to solely execute backend.list-objects
-	Flags             uint64      `json:"flags,string"`          // enum {LsCached, ...} - "LsoMsg flags" above
-	PageSize          int64       `json:"pagesize"`              // max entries returned by list objects call
-}
+type (
+	// swagger:model
+	LsoMsg struct {
+		Header            http.Header `json:"hdr,omitempty"`         // (for pointers, see `ListArgs` in api/ls.go)
+		UUID              string      `json:"uuid"`                  // ID to identify a single multi-page request
+		Props             string      `json:"props"`                 // comma-delimited, e.g. "checksum,size,custom" (see GetProps* enum)
+		TimeFormat        string      `json:"time_format,omitempty"` // RFC822 is the default
+		Prefix            string      `json:"prefix"`                // return names starting with prefix (including arch. files (e.g. "A.tar/tutorials/"))
+		StartAfter        string      `json:"start_after,omitempty"` // start listing after (AIS buckets only)
+		ContinuationToken string      `json:"continuation_token"`    // => LsoResult.ContinuationToken => LsoMsg.ContinuationToken
+		SID               string      `json:"target"`                // selected target to solely execute backend.list-objects
+		Flags             uint64      `json:"flags,string"`          // enum {LsCached, ...} - "LsoMsg flags" above
+		PageSize          int64       `json:"pagesize"`              // max entries returned by list objects call
+	}
+
+	CreateInvMsg struct {
+		Name string `json:"name,omitempty"` // inventory name (optional; must be unique for a given bucket)
+		LsoMsg
+	}
+)
 
 ////////////
 // LsoMsg //