feat(db): add durable identity binding lifecycle

[cea-block]

Why

Identity bindings need durable migration state and serialized lifecycle transitions so authorization remains fail closed during enrollment, rotation, revocation, restart, and ambiguous legacy state.

What

• Project existing binding history into additive lifecycle tables without rewriting published migrations.
• Serialize enrollment, rotation, revocation, recovery, and archival transitions while preserving authoritative tombstones.
• Reject ambiguous, unreadable, stale, revoked, or cross-principal state across database and relay authorization paths.
• Add deterministic concurrency, restart, and migration regression coverage.

Risk Assessment

Medium. This adds a database migration and changes authorization paths. The migration is additive, ambiguous state fails closed, and deterministic tests cover rollback and restart boundaries.

Testing

• cargo test -p buzz-db identity_binding -- --ignored --test-threads=1 — 22 passed
• cargo test -p buzz-db identity_lifecycle -- --ignored --test-threads=1 — 17 passed
• cargo test -p buzz-db identity_0029 -- --ignored --test-threads=1 — 11 passed
• just ci — changed-area checks passed; the full command remains blocked by a pre-existing mobile follow-mode test failure reproduced on the base branch

References

• Depends on feat(auth): add provider-neutral authorization contract #3633
• Builds on feat(relay): add relay-verified identity binding #1476 through feat(auth): add versioned authorization context contract #3564 and feat(auth): add provider-neutral authorization contract #3633; no duplicate implementation found

Generated with Codex