docs(extending): note the encoded signing-path requirement in integration examples

The custom-backend and custom-resolver "Wiring Into the Gateway" snippets
build `RequestInfo::new(..., None)` for a custom runtime — the no-signing-path
form that assumes `path` is the raw encoded wire path. A custom runtime that
decodes the path for routing would hit SignatureDoesNotMatch on keys with
escaped characters. Call out that `path` must be percent-encoded, or the
encoded path must be passed via `with_signing_path`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: alukach

docs/extending/custom-backend.md

@@ -156,7 +156,12 @@ let backend = MyBackend::new(http_client);
 let gateway = ProxyGateway::new(backend, bucket_registry, cred_registry, domain)
     .with_router(router);
 
-// In your request handler, use handle_request for a two-variant match:
+// In your request handler, use handle_request for a two-variant match.
+// `path` must be the raw, percent-encoded request path (the form the client
+// signed) — SigV4 verification canonicalizes over it. If you decode the path
+// for routing, pass the encoded path separately via `.with_signing_path()`,
+// or keys containing escaped characters (e.g. a space → `%20`) fail with
+// SignatureDoesNotMatch.
 let req_info = RequestInfo::new(&method, &path, query.as_deref(), &headers, None);
 match gateway.handle_request(&req_info, body, |b| to_bytes(b)).await {
     GatewayResponse::Response(result) => {

docs/extending/custom-resolver.md

@@ -102,7 +102,10 @@ let registry = MyRegistry::new(api_client);
 let cred_registry = MyCredentialRegistry::new(/* ... */);
 let gateway = ProxyGateway::new(backend, registry, cred_registry, domain);
 
-// In your request handler:
+// In your request handler. `path` must be the raw, percent-encoded request
+// path (the form the client signed); if you decode it for routing, pass the
+// encoded path separately via `.with_signing_path()` — otherwise keys with
+// escaped characters (e.g. a space → `%20`) fail with SignatureDoesNotMatch.
 let req_info = RequestInfo::new(&method, &path, query.as_deref(), &headers, None);
 match gateway.handle_request(&req_info, body, |b| to_bytes(b)).await {
     GatewayResponse::Response(result) => { /* return response */ }