Fix production migration privilege compatibility

Rescope OOBE claims with permitted ALTER operations and make deployment smoke validation require every migration through V28.

deploy/smoke-local.sh

@@ -477,9 +477,9 @@ WHERE version IS NOT NULL
 ORDER BY installed_rank;
 SQL
 )"
-EXPECTED_MIGRATIONS="$(seq 1 27 | awk '{ print $1 ":1" }')"
+EXPECTED_MIGRATIONS="$(seq 1 28 | awk '{ print $1 ":1" }')"
 [[ "$MIGRATIONS" == "$EXPECTED_MIGRATIONS" ]] ||
-    fail "Flyway history was not exactly successful V1-V27"
+    fail "Flyway history was not exactly successful V1-V28"
 REFERRAL_REWARDS="$(
     mysql_root --batch --skip-column-names osg_account_smoke <<'SQL'
 SELECT CONCAT(inviter_reward_credits, ':', invitee_reward_credits)

src/main/resources/db/migration/V27__scope_oobe_claims_to_grant.sql

@@ -1,23 +1,11 @@
-DROP TABLE oobe_gateway_claims;
+-- Claims are intentionally short-lived and may be discarded when switching
+-- their idempotency scope from subject to grant.
+DELETE FROM oobe_gateway_claims;
 
-CREATE TABLE oobe_gateway_claims (
+ALTER TABLE oobe_gateway_claims
-    grant_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    DROP PRIMARY KEY,
-    subject_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ADD COLUMN grant_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL FIRST,
-    feature VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ADD PRIMARY KEY (grant_id, feature),
-    request_id VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ADD INDEX idx_oobe_claim_subject (subject_id),
-    status VARCHAR(16) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ADD CONSTRAINT fk_oobe_claim_grant
-    expires_at TIMESTAMP(6) NOT NULL,
+        FOREIGN KEY (grant_id) REFERENCES oobe_gateway_grants (id) ON DELETE CASCADE;
-    created_at TIMESTAMP(6) NOT NULL,
-    updated_at TIMESTAMP(6) NOT NULL,
-    PRIMARY KEY (grant_id, feature),
-    INDEX idx_oobe_claim_subject (subject_id),
-    INDEX idx_oobe_claim_expiry (status, expires_at),
-    CONSTRAINT fk_oobe_claim_grant
-        FOREIGN KEY (grant_id) REFERENCES oobe_gateway_grants (id) ON DELETE CASCADE,
-    CONSTRAINT fk_oobe_claim_subject
-        FOREIGN KEY (subject_id) REFERENCES oobe_subjects (id) ON DELETE CASCADE,
-    CONSTRAINT chk_oobe_claim_feature
-        CHECK (feature IN ('VOICE_INPUT', 'CLIPBOARD_TRANSLATE', 'CLIPBOARD_REPLY', 'ASK_AI')),
-    CONSTRAINT chk_oobe_claim_status
-        CHECK (status IN ('CLAIMED', 'CONSUMED'))
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;

src/test/kotlin/com/osglab/account/config/SmokeDeploymentTest.kt

@@ -37,7 +37,7 @@ class SmokeDeploymentTest : FunSpec({
         runner shouldContain "APPLE_JWKS_URL=http://127.0.0.1:9/"
         runner shouldContain "VOLCENGINE_ASR_ENDPOINT=ws://127.0.0.1:9/"
         runner shouldContain "DEEPSEEK_ENDPOINT=http://127.0.0.1:9/"
-        runner shouldContain "Flyway history was not exactly successful V1-V27"
+        runner shouldContain "Flyway history was not exactly successful V1-V28"
         runner shouldContain "default referral rewards were not 1000 credits for both accounts"
         runner shouldContain "active smaller credit rates did not match the V10 contract"
         runner shouldContain "first ledger page omitted nextCursor"