feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/repositories/portfolio_repository.py

@@ -110,6 +110,10 @@ class PortfolioRepository(Protocol):
         is_active: bool | None = None,
     ) -> Daemon: ...
 
+    def revoke_tokens_by_daemon_id(self, daemon_id: str) -> int: ...
+
+    def list_service_tokens_with_null_daemon(self) -> list[AuthToken]: ...
+
     def get(self, portfolio_id: str) -> Portfolio: ...
 
     def get_portfolio_by_name_and_user(self, owner_user_id: str, name: str) -> Portfolio | None: ...