feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/cli/commands/daemon.py

@@ -66,8 +66,14 @@ def update_daemon(
     display_name: Optional[str] = typer.Option(None, "--display-name", help="New display name."),
     deactivate: bool = typer.Option(False, "--deactivate", help="Mark daemon as inactive."),
     activate: bool = typer.Option(False, "--activate", help="Mark daemon as active."),
+    force: bool = typer.Option(False, "--force", "-f", help="Skip confirmation when deactivating."),
 ) -> None:
     """Update a daemon registry entry."""
+    if deactivate and not force:
+        confirmed = typer.confirm(f"Daemon {daemon_id}을(를) 비활성화하면 바인딩된 service token이 즉시 revoke됩니다. 계속하시겠습니까?")
+        if not confirmed:
+            raise typer.Exit(code=0)
+
     def _update(repo, app_context):
         is_active: bool | None = None
         if deactivate and activate:
@@ -76,7 +82,11 @@ def update_daemon(
             is_active = False
         elif activate:
             is_active = True
-        return repo.update_daemon(daemon_id, display_name=display_name, is_active=is_active)
+        result = repo.update_daemon(daemon_id, display_name=display_name, is_active=is_active)
+        if deactivate:
+            revoked_count = repo.revoke_tokens_by_daemon_id(daemon_id)
+            app_context.console.print(f"Revoked {revoked_count} service token(s) bound to daemon {daemon_id}.")
+        return result
 
     result = _with_service(ctx, _update)
     render_output(ctx.obj.console, ctx.obj.output_format, result)