Fix production migration privilege compatibility

Rescope OOBE claims with permitted ALTER operations and make deployment smoke validation require every migration through V28.

deploy/smoke-local.sh

@@ -477,9 +477,9 @@ WHERE version IS NOT NULL
 ORDER BY installed_rank;
 SQL
 )"
-EXPECTED_MIGRATIONS="$(seq 1 27 | awk '{ print $1 ":1" }')"
+EXPECTED_MIGRATIONS="$(seq 1 28 | awk '{ print $1 ":1" }')"
 [[ "$MIGRATIONS" == "$EXPECTED_MIGRATIONS" ]] ||
-    fail "Flyway history was not exactly successful V1-V27"
+    fail "Flyway history was not exactly successful V1-V28"
 REFERRAL_REWARDS="$(
     mysql_root --batch --skip-column-names osg_account_smoke <<'SQL'
 SELECT CONCAT(inviter_reward_credits, ':', invitee_reward_credits)

src/main/resources/db/migration/V27__scope_oobe_claims_to_grant.sql

@@ -1,23 +1,11 @@
-DROP TABLE oobe_gateway_claims;
+-- Claims are intentionally short-lived and may be discarded when switching
+-- their idempotency scope from subject to grant.
+DELETE FROM oobe_gateway_claims;
 
-CREATE TABLE oobe_gateway_claims (
-    grant_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
-    subject_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
-    feature VARCHAR(32) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
-    request_id VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
-    status VARCHAR(16) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
-    expires_at TIMESTAMP(6) NOT NULL,
-    created_at TIMESTAMP(6) NOT NULL,
-    updated_at TIMESTAMP(6) NOT NULL,
-    PRIMARY KEY (grant_id, feature),
-    INDEX idx_oobe_claim_subject (subject_id),
-    INDEX idx_oobe_claim_expiry (status, expires_at),
-    CONSTRAINT fk_oobe_claim_grant
-        FOREIGN KEY (grant_id) REFERENCES oobe_gateway_grants (id) ON DELETE CASCADE,
-    CONSTRAINT fk_oobe_claim_subject
-        FOREIGN KEY (subject_id) REFERENCES oobe_subjects (id) ON DELETE CASCADE,
-    CONSTRAINT chk_oobe_claim_feature
-        CHECK (feature IN ('VOICE_INPUT', 'CLIPBOARD_TRANSLATE', 'CLIPBOARD_REPLY', 'ASK_AI')),
-    CONSTRAINT chk_oobe_claim_status
-        CHECK (status IN ('CLAIMED', 'CONSUMED'))
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+ALTER TABLE oobe_gateway_claims
+    DROP PRIMARY KEY,
+    ADD COLUMN grant_id VARCHAR(36) CHARACTER SET ascii COLLATE ascii_bin NOT NULL FIRST,
+    ADD PRIMARY KEY (grant_id, feature),
+    ADD INDEX idx_oobe_claim_subject (subject_id),
+    ADD CONSTRAINT fk_oobe_claim_grant
+        FOREIGN KEY (grant_id) REFERENCES oobe_gateway_grants (id) ON DELETE CASCADE;

src/test/kotlin/com/osglab/account/config/SmokeDeploymentTest.kt

@@ -37,7 +37,7 @@ class SmokeDeploymentTest : FunSpec({
         runner shouldContain "APPLE_JWKS_URL=http://127.0.0.1:9/"
         runner shouldContain "VOLCENGINE_ASR_ENDPOINT=ws://127.0.0.1:9/"
         runner shouldContain "DEEPSEEK_ENDPOINT=http://127.0.0.1:9/"
-        runner shouldContain "Flyway history was not exactly successful V1-V27"
+        runner shouldContain "Flyway history was not exactly successful V1-V28"
         runner shouldContain "default referral rewards were not 1000 credits for both accounts"
         runner shouldContain "active smaller credit rates did not match the V10 contract"
         runner shouldContain "first ledger page omitted nextCursor"