feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/cli/commands/service_tokens.py

@@ -162,3 +162,36 @@ def revoke_service_token(
         revoked_at=revoked_at,
     )
     render_service_token_result(ctx.obj.console, ctx.obj.output_format, response)
+
+
+@token_app.command("migrate-null-daemon")
+def migrate_null_daemon(
+    ctx: typer.Context,
+    dry_run: bool = typer.Option(False, "--dry-run", help="Inspect NULL daemon tokens without making changes."),
+) -> None:
+    """Diagnose and report active service tokens with no daemon binding (NULL daemon_id)."""
+    if not dry_run:
+        ctx.obj.console.print(
+            "[red]자동 변경은 지원하지 않습니다.[/red] "
+            "먼저 --dry-run으로 inventory를 확인한 후 "
+            "token별로 `pfhub service-token rebind NAME --daemon-id ID` 또는 "
+            "`pfhub service-token revoke NAME`을 수동 실행하세요."
+        )
+        raise typer.Exit(code=1)
+
+    def _inspect(service: AuthService, app_context):
+        tokens = service.list_null_daemon_service_tokens()
+        if not tokens:
+            app_context.console.print("no NULL daemon tokens found.")
+            return
+
+        for token in tokens:
+            candidates = service.find_candidate_daemons_for_user(token.user_id)
+            candidate_ids = [d.id for d in candidates]
+            match_note = f"candidates={candidate_ids}" if candidate_ids else "[yellow]no candidate daemons for this user[/yellow]"
+            app_context.console.print(
+                f"id={token.id} user_id={token.user_id} name={token.name} "
+                f"runtime_id={token.runtime_id} created_at={token.created_at} {match_note}"
+            )
+
+    _with_service(ctx, _inspect)