feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/services/auth_service.py

@@ -18,7 +18,6 @@ from app.domain.models import AuthToken, User
 from app.repositories.factory import get_portfolio_repository_from_settings
 from app.repositories.portfolio_repository import PortfolioRepository
 from app.schemas.auth import (
-    CreateClientTokenRequest,
     LoginRequest,
 )
 
@@ -30,12 +29,6 @@ class LoginResult:
     user: User
 
 
-@dataclass
-class IssuedClientToken:
-    token: str
-    auth_token: AuthToken
-
-
 @dataclass
 class IssuedServiceToken:
     token: str
@@ -71,30 +64,6 @@ class AuthService:
         refreshed_user = self._repository.get_user(user.id)
         return LoginResult(token=raw_token, auth_token=auth_token, user=refreshed_user)
 
-    def issue_client_token(self, auth_context: AuthContext, payload: CreateClientTokenRequest) -> IssuedClientToken:
-        if auth_context.token_type == "service":
-            raise ValueError("서비스 토큰으로는 사용자 클라이언트 토큰을 발급할 수 없습니다")
-        if auth_context.user_id is None:
-            raise ValueError("DB 사용자 컨텍스트에서만 클라이언트 토큰을 발급할 수 있습니다")
-
-        requested = Permission(payload.permission or auth_context.permission.value)
-        if not _has_permission(auth_context.permission, requested):
-            raise ValueError("요청한 토큰 권한이 현재 권한을 초과합니다")
-
-        raw_token = generate_token()
-        expires_at = self._build_expiration(payload.expires_in_days, self._settings.client_token_default_ttl_days)
-
-        auth_token = self._repository.create_auth_token(
-            auth_context.user_id,
-            name=payload.name,
-            token_hash=hash_token(raw_token),
-            token_prefix=token_prefix(raw_token),
-            permission=requested.value,
-            token_type="client",
-            expires_at=expires_at,
-        )
-        return IssuedClientToken(token=raw_token, auth_token=auth_token)
-
     def list_tokens(self, auth_context: AuthContext) -> list[AuthToken]:
         if auth_context.token_type == "service":
             raise ValueError("서비스 토큰으로는 사용자 토큰 목록을 조회할 수 없습니다")
@@ -183,6 +152,15 @@ class AuthService:
         self._repository.revoke_auth_token(existing.user_id, existing.id)
         return datetime.now(timezone.utc)
 
+    def revoke_tokens_for_daemon(self, daemon_id: str) -> int:
+        return self._repository.revoke_tokens_by_daemon_id(daemon_id)
+
+    def list_null_daemon_service_tokens(self) -> list[AuthToken]:
+        return self._repository.list_service_tokens_with_null_daemon()
+
+    def find_candidate_daemons_for_user(self, user_id: str) -> list:
+        return self._repository.list_daemons_for_user(user_id)
+
     def list_service_tokens(
         self,
         username: str | None = None,
@@ -197,12 +175,6 @@ class AuthService:
             user_id = user.id
         return self._repository.list_service_tokens(user_id, include_revoked=include_revoked)
 
-    @staticmethod
-    def _build_expiration(expires_in_days: int | None, default_days: int) -> datetime:
-        days = normalize_expiry_days(expires_in_days, default_days=default_days)
-        return datetime.now(timezone.utc) + timedelta(days=days)
-
-
 def get_auth_service(
     settings: Settings = Depends(get_settings),
     repository: PortfolioRepository = Depends(get_auth_service_repository),