docs: add rel-003, rel-004 releases and update CLI user scoping implementation

Release: REL-003_20260512 — CLI user scoping and local DB ops runbook

Requirements & Batches:
- BAT-003 (REQ-013): portfolio list --user required enforcement with owner filtering
- BAT-004 (REQ-014): portfolio create --user required enforcement with owner assignment
- BAT-007 (REQ-001/002/003): local DB validation runbook and baseline docs update

CLI Enhancements:
- Update user.py: add username-based user lookup (get_by_username)
- Add UserDetailResponse schema with service token listing
- Update list_service_tokens API in user_service.py
- Enhance user detail display with service token information
- Add service_token_count and service_token_names to user responses

Testing:
- Add comprehensive test coverage in test_cli.py for user commands
- Validate username-based lookup functionality

Release: REL-004_20260512 — Portfolio UUID migration and API UUID switch

Requirements & Batches:
- BAT-006 (REQ-016/017/018): portfolio UUID migration complete
- BAT-008 (REQ-019): baseline documentation update for UUID migration

Breaking Changes (REL-003):
- portfolio list requires --user <username> parameter
- portfolio create requires --user <username> parameter

Documentation:
- Create rel-003 and rel-004 release documents with rollout and rollback plans
- Update docs/releases/index.md with new releases
- Update README.md with CLI user scoping clarification
- Sync all release verification checklists and deployment notes

app/cli/commands/user.py

@@ -6,7 +6,7 @@ import typer
 
 from app.cli.core.utils import execute_command, render_output
 from app.cli.commands.portfolio import _confirm
-from app.schemas.user import CreateUserRequest, UpdateUserRequest, UserResponse
+from app.schemas.user import CreateUserRequest, UpdateUserRequest, UserDetailResponse, UserResponse
 from app.services.user_service import UserService
 
 
@@ -37,6 +37,21 @@ def _to_user_response(user) -> UserResponse:
     )
 
 
+def _to_user_detail_response(user, service_token_names: list[str]) -> UserDetailResponse:
+    return UserDetailResponse(
+        id=user.id,
+        username=user.username,
+        email=user.email,
+        permission=user.permission,
+        is_active=user.is_active,
+        created_at=user.created_at,
+        updated_at=user.updated_at,
+        last_login_at=user.last_login_at,
+        service_token_count=len(service_token_names),
+        service_token_names=service_token_names,
+    )
+
+
 @user_app.command("list")
 def list_users(ctx: typer.Context) -> None:
     users = _with_service(ctx, lambda service, app_context: [_to_user_response(user) for user in service.list()])
@@ -46,9 +61,17 @@ def list_users(ctx: typer.Context) -> None:
 @user_app.command("get")
 def get_user(
     ctx: typer.Context,
-    user_id: str = typer.Argument(..., help="User identifier."),
+    username: str = typer.Argument(..., help="Username."),
 ) -> None:
-    user = _with_service(ctx, lambda service, app_context: _to_user_response(service.get(user_id)))
+    def _get(service: UserService, app_context) -> UserDetailResponse:
+        user = service.get_by_username(username)
+        service_token_names = sorted(token.name for token in service.list_service_tokens(user.id))
+        return _to_user_detail_response(user, service_token_names)
+
+    user = _with_service(
+        ctx,
+        _get,
+    )
     render_output(ctx.obj.console, ctx.obj.output_format, user)
 
 

app/cli/core/utils.py

@@ -122,38 +122,41 @@ def print_portfolio_detail(console: Console, detail: PortfolioDetailResponse) ->
 
 
 def print_user_table(console: Console, users: list[UserResponse]) -> None:
-    table = Table(title="Users", expand=True)
-    table.add_column("ID", style="cyan", no_wrap=True)
-    table.add_column("Username", no_wrap=True)
-    table.add_column("Email")
-    table.add_column("Created At", no_wrap=True)
-    table.add_column("Updated At", no_wrap=True)
-    for user in users:
-        table.add_row(
-            user.id,
-            user.username,
-            user.email or "N/A",
-            user.created_at.isoformat(timespec="seconds") if user.created_at else "N/A",
-            user.updated_at.isoformat(timespec="seconds") if user.updated_at else "N/A",
-        )
-    console.print(table)
+    for i, user in enumerate(users, 1):
+        lines = [
+            f"username: {user.username}",
+            f"id: {user.id}",
+            f"email: {user.email or 'N/A'}",
+            f"permission: {user.permission}",
+            f"is_active: {'true' if user.is_active else 'false'}",
+            f"created_at: {user.created_at.isoformat(timespec='seconds') if user.created_at else 'N/A'}",
+            f"updated_at: {user.updated_at.isoformat(timespec='seconds') if user.updated_at else 'N/A'}",
+        ]
+        for line in lines:
+            console.print(line)
+        if i < len(users):
+            console.print()
 
 
 def print_user_detail(console: Console, user: UserResponse) -> None:
-    console.print(
-        Panel.fit(
-            "\n".join(
-                [
-                    f"id: {user.id}",
-                    f"username: {user.username}",
-                    f"email: {user.email or 'N/A'}",
-                    f"created_at: {user.created_at.isoformat(timespec='seconds') if user.created_at else 'N/A'}",
-                    f"updated_at: {user.updated_at.isoformat(timespec='seconds') if user.updated_at else 'N/A'}",
-                ]
-            ),
-            title="User",
-        )
-    )
+    lines = [
+        f"id: {user.id}",
+        f"username: {user.username}",
+        f"email: {user.email or 'N/A'}",
+        f"permission: {user.permission}",
+        f"is_active: {'true' if user.is_active else 'false'}",
+        f"last_login_at: {user.last_login_at.isoformat(timespec='seconds') if user.last_login_at else 'N/A'}",
+        f"created_at: {user.created_at.isoformat(timespec='seconds') if user.created_at else 'N/A'}",
+        f"updated_at: {user.updated_at.isoformat(timespec='seconds') if user.updated_at else 'N/A'}",
+    ]
+    service_token_count = getattr(user, "service_token_count", None)
+    service_token_names = getattr(user, "service_token_names", None)
+    if service_token_count is not None and service_token_names is not None:
+        rendered_names = ", ".join(service_token_names) if service_token_names else "N/A"
+        lines.append(f"service_token_count: {service_token_count}")
+        lines.append(f"service_token_names: {rendered_names}")
+    for line in lines:
+        console.print(line)
 
 
 def print_service_token_list(console: Console, tokens: list[AuthTokenResponse]) -> None:

app/schemas/user.py

@@ -19,6 +19,11 @@ class UserResponse(BaseModel):
     last_login_at: datetime | None = None
 
 
+class UserDetailResponse(UserResponse):
+    service_token_count: int = 0
+    service_token_names: list[str] = Field(default_factory=list)
+
+
 class CreateUserRequest(BaseModel):
     username: str = Field(min_length=1)
     email: str | None = None

app/services/user_service.py

@@ -6,7 +6,7 @@ from fastapi import Depends
 
 from app.core.config import Settings, get_settings
 from app.core.security import hash_password
-from app.domain.models import User
+from app.domain.models import AuthToken, User
 from app.repositories.factory import get_portfolio_repository_from_settings
 from app.repositories.portfolio_repository import PortfolioRepository
 from app.schemas.user import CreateUserRequest, UpdateUserRequest
@@ -26,6 +26,15 @@ class UserService:
     def get(self, user_id: str) -> User:
         return self._repository.get_user(user_id)
 
+    def get_by_username(self, username: str) -> User:
+        user = self._repository.get_user_by_username(username)
+        if user is None:
+            raise ValueError(f"사용자를 찾을 수 없습니다: {username}")
+        return user
+
+    def list_service_tokens(self, user_id: str, *, include_revoked: bool = True) -> list[AuthToken]:
+        return self._repository.list_service_tokens(user_id, include_revoked=include_revoked)
+
     def create(self, payload: CreateUserRequest) -> User:
         return self._repository.create_user(
             payload.username,