Summary

The axum Query<HashMap<String,String>> extraction — and the query_params map on AwsRequest derived from it — collapses repeated query keys, keeping only the last value of ?Id=a&Id=b&Id=c. That silently drops multi-value @httpQuery parameters (list-style filters / ids). This is the known-systemic finding 1.45 (LOW).

raw_query already preserves the full query string, so rather than a repo-wide change to the core representation, this adds first-class recovery:

• AwsRequest::query_param_all(key) -> Vec<String> — re-parses raw_query and returns every occurrence of a repeated key, in wire order (empty vec if absent).
• pub(crate) protocol::form_urlencoded_pairs(&str) -> Vec<(String, String)> — decodes into ordered pairs, reusing the existing UTF-8-correct url_decode (the HashMap decoder that collapses repeats is untouched).

Handlers that legitimately accept repeated keys can now recover them without every caller re-implementing query parsing, and without disturbing the query_params fast path every other handler relies on.

Test plan

• cargo test -p fakecloud-core --lib form_urlencoded_pairs — repeated keys preserved as [a, b, c] (vs the HashMap form collapsing to c); percent/+ decoding (caf%C3%A9+bar → café bar).
• cargo clippy -p fakecloud-core --tests -- -D warnings clean.

Additive API only — no existing behavior changes, no SDK/docs surface.

Summary by cubic

Adds AwsRequest::query_param_all to return all values of repeated @httpquery params by re-parsing raw_query, fixing the drop of multi-value filters (bug-hunt 1.45). The existing HashMap-based query_params behavior stays unchanged.

• New Features
  • query_param_all(key) -> Vec returns every occurrence in wire order; empty when absent.
  • pub(crate) form_urlencoded_pairs(&str) -> Vec<(String, String)> decodes ordered key/value pairs (handles percent and +) for internal use.

^{Written for commit 66ad932. Summary will update on new commits.}