Retire bootstrap and static-token authorization authority

[shiny-code-bot]

Objective

Retire authorization authority that currently exists outside the DB policy model and separate database runtime from migration privilege.

Current Status

State: Planned remediation under #2061 from #2060 findings. No credential, bootstrap, session, or database-role mutation is authorized until migration and rollback are reviewed.

Scope

• Replace continuing bootstrap-admin email role overrides with one-time immutable administrator enrollment and persisted bootstrap completion.
• Reject or ignore bootstrap identity inputs after cutover according to an explicit fail-closed startup contract.
• Convert Every Code and engineering worker shared tokens into DB-backed service principals with hashed credentials, status, expiry, rotation, exact actions, and concrete audit identity.
• Remove identity=None authorization bypasses.
• Separate schema-owner/migrator credentials from the long-running runtime service role.
• Restrict authorization-policy writes to the reviewed CAS path or a dedicated policy-writer function/role.
• Add rotation, revocation, disaster recovery, compatibility, and rollback tests.

Acceptance Criteria

• Bootstrap email cannot grant or restore a runtime role after bootstrap completion.
• Every worker request resolves to a concrete revocable DB-backed principal.
• Runtime compromise does not automatically provide schema-owner/migration privilege.
• Direct DB policy replacement outside the reviewed path is denied or independently audited and recovery-gated.
• Existing workers and sessions migrate without an authorization gap and can be rolled back safely.

Finish Line

All ordinary human and service-principal authorization is DB-backed, revocable, attributable, and independent from bootstrap environment and schema-migration credentials.