feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/auth_routes.py

@@ -10,15 +10,13 @@ from app.core.auth import AuthContext, require_admin, require_read
 from app.domain.models import AuthToken, User
 from app.schemas.auth import (
     AuthTokenResponse,
-    CreateClientTokenRequest,
-    IssuedClientTokenResponse,
     IssueServiceTokenRequest,
     IssueServiceTokenApiResponse,
     LoginRequest,
     TokenResponse,
 )
 from app.schemas.user import UserResponse
-from app.services.auth_service import AuthService, IssuedClientToken, LoginResult, get_auth_service
+from app.services.auth_service import AuthService, LoginResult, get_auth_service
 
 router = APIRouter(prefix="/auth", tags=["auth"])
 
@@ -60,13 +58,6 @@ def _to_login_response(result: LoginResult) -> TokenResponse:
     )
 
 
-def _to_issued_token_response(result: IssuedClientToken) -> IssuedClientTokenResponse:
-    return IssuedClientTokenResponse(
-        token=result.token,
-        auth_token=_to_auth_token_response(result.auth_token),
-    )
-
-
 def _raise_auth_error(exc: ValueError) -> NoReturn:
     detail = str(exc)
     if "잘못된 사용자명 또는 비밀번호" in detail:
@@ -97,18 +88,6 @@ def list_tokens(
         _raise_auth_error(exc)
 
 
-@router.post("/tokens", response_model=IssuedClientTokenResponse, status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_read)])
-def create_token(
-    payload: CreateClientTokenRequest,
-    auth_context: AuthContext = Depends(require_read),
-    service: AuthService = Depends(get_auth_service),
-) -> IssuedClientTokenResponse:
-    try:
-        return _to_issued_token_response(service.issue_client_token(auth_context, payload))
-    except ValueError as exc:
-        _raise_auth_error(exc)
-
-
 @router.delete("/tokens/{token_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_read)])
 def revoke_token(
     token_id: str,
@@ -134,6 +113,7 @@ def issue_service_token(
             permission=payload.permission,
             expires_in_days=payload.expires_in_days,
             no_expiry=payload.no_expiry,
+            daemon_id=payload.daemon_id,
         )
     except ValueError as exc:
         _raise_auth_error(exc)