feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/versions/20260520_0022_service_token_unique_index_fix.py

@@ -0,0 +1,66 @@
+"""service_token rotate unique index 보강: revoked_at IS NULL 조건 추가 (REQ-017)
+
+Revision ID: 20260520_0022
+Revises: 20260519_0021
+Create Date: 2026-05-20 00:00:00
+"""
+
+from __future__ import annotations
+
+from alembic import op
+from sqlalchemy import inspect
+
+
+revision = "20260520_0022"
+down_revision = "20260519_0021"
+branch_labels = None
+depends_on = None
+
+
+def _index_exists(inspector, table_name: str, index_name: str) -> bool:
+    return any(idx["name"] == index_name for idx in inspector.get_indexes(table_name))
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+
+    if _index_exists(inspector, "auth_tokens", "idx_auth_tokens_service_name_unique"):
+        bind.execute(
+            __import__("sqlalchemy").text(
+                "DROP INDEX IF EXISTS idx_auth_tokens_service_name_unique"
+            )
+        )
+
+    autocommit_bind = bind.execution_options(isolation_level="AUTOCOMMIT")
+    autocommit_bind.execute(
+        __import__("sqlalchemy").text(
+            """
+            CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS idx_auth_tokens_service_name_unique
+            ON auth_tokens (name)
+            WHERE token_type = 'service' AND revoked_at IS NULL
+            """
+        )
+    )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+
+    if _index_exists(inspector, "auth_tokens", "idx_auth_tokens_service_name_unique"):
+        bind.execute(
+            __import__("sqlalchemy").text(
+                "DROP INDEX IF EXISTS idx_auth_tokens_service_name_unique"
+            )
+        )
+
+    bind.execute(
+        __import__("sqlalchemy").text(
+            """
+            CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_tokens_service_name_unique
+            ON auth_tokens (name)
+            WHERE token_type = 'service'
+            """
+        )
+    )