feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/cli/commands/daemon.py

@@ -66,8 +66,14 @@ def update_daemon(
     display_name: Optional[str] = typer.Option(None, "--display-name", help="New display name."),
     deactivate: bool = typer.Option(False, "--deactivate", help="Mark daemon as inactive."),
     activate: bool = typer.Option(False, "--activate", help="Mark daemon as active."),
+    force: bool = typer.Option(False, "--force", "-f", help="Skip confirmation when deactivating."),
 ) -> None:
     """Update a daemon registry entry."""
+    if deactivate and not force:
+        confirmed = typer.confirm(f"Daemon {daemon_id}을(를) 비활성화하면 바인딩된 service token이 즉시 revoke됩니다. 계속하시겠습니까?")
+        if not confirmed:
+            raise typer.Exit(code=0)
+
     def _update(repo, app_context):
         is_active: bool | None = None
         if deactivate and activate:
@@ -76,7 +82,11 @@ def update_daemon(
             is_active = False
         elif activate:
             is_active = True
-        return repo.update_daemon(daemon_id, display_name=display_name, is_active=is_active)
+        result = repo.update_daemon(daemon_id, display_name=display_name, is_active=is_active)
+        if deactivate:
+            revoked_count = repo.revoke_tokens_by_daemon_id(daemon_id)
+            app_context.console.print(f"Revoked {revoked_count} service token(s) bound to daemon {daemon_id}.")
+        return result
 
     result = _with_service(ctx, _update)
     render_output(ctx.obj.console, ctx.obj.output_format, result)

app/cli/commands/service_tokens.py

@@ -162,3 +162,36 @@ def revoke_service_token(
         revoked_at=revoked_at,
     )
     render_service_token_result(ctx.obj.console, ctx.obj.output_format, response)
+
+
+@token_app.command("migrate-null-daemon")
+def migrate_null_daemon(
+    ctx: typer.Context,
+    dry_run: bool = typer.Option(False, "--dry-run", help="Inspect NULL daemon tokens without making changes."),
+) -> None:
+    """Diagnose and report active service tokens with no daemon binding (NULL daemon_id)."""
+    if not dry_run:
+        ctx.obj.console.print(
+            "[red]자동 변경은 지원하지 않습니다.[/red] "
+            "먼저 --dry-run으로 inventory를 확인한 후 "
+            "token별로 `pfhub service-token rebind NAME --daemon-id ID` 또는 "
+            "`pfhub service-token revoke NAME`을 수동 실행하세요."
+        )
+        raise typer.Exit(code=1)
+
+    def _inspect(service: AuthService, app_context):
+        tokens = service.list_null_daemon_service_tokens()
+        if not tokens:
+            app_context.console.print("no NULL daemon tokens found.")
+            return
+
+        for token in tokens:
+            candidates = service.find_candidate_daemons_for_user(token.user_id)
+            candidate_ids = [d.id for d in candidates]
+            match_note = f"candidates={candidate_ids}" if candidate_ids else "[yellow]no candidate daemons for this user[/yellow]"
+            app_context.console.print(
+                f"id={token.id} user_id={token.user_id} name={token.name} "
+                f"runtime_id={token.runtime_id} created_at={token.created_at} {match_note}"
+            )
+
+    _with_service(ctx, _inspect)