Add complimentary OOBE polish and configurable admin mTLS

Allow one server-audited onboarding polish request without credits and make the certificate gate temporarily reversible while preserving application authentication.

src/main/resources/application.yaml

@@ -32,6 +32,7 @@ app:
     tombstoneRetentionDays: "$IDENTITY_TOMBSTONE_RETENTION_DAYS:365"
   admin:
     enabled: "$ADMIN_ENABLED:false"
+    mtlsRequired: "$ADMIN_MTLS_REQUIRED:true"
     bootstrapEnabled: "$ADMIN_BOOTSTRAP_ENABLED:false"
     bootstrapOperatorId: "$ADMIN_BOOTSTRAP_OPERATOR_ID:"
     bootstrapUsername: "$ADMIN_BOOTSTRAP_USERNAME:"

src/main/resources/db/migration/V17__gateway_oobe_complimentary_requests.sql

@@ -0,0 +1,21 @@
+ALTER TABLE provider_requests
+    ADD COLUMN request_purpose VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NULL
+        AFTER request_source,
+    ADD INDEX idx_provider_requests_purpose_created (request_purpose, created_at);
+
+CREATE TABLE gateway_complimentary_requests (
+    account_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    purpose VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    capability VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    request_id VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    status VARCHAR(16) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    expires_at TIMESTAMP(6) NOT NULL,
+    created_at TIMESTAMP(6) NOT NULL,
+    updated_at TIMESTAMP(6) NOT NULL,
+    PRIMARY KEY (account_id, purpose, capability),
+    INDEX idx_gateway_complimentary_expiry (status, expires_at),
+    CONSTRAINT fk_gateway_complimentary_account
+        FOREIGN KEY (account_id) REFERENCES accounts (id) ON DELETE CASCADE,
+    CONSTRAINT chk_gateway_complimentary_status
+        CHECK (status IN ('CLAIMED', 'CONSUMED'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;