feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_auth_surface_after_client_deprecation.py

@@ -0,0 +1,58 @@
+"""REQ-016: client token 발급 경로 폐지 후 표면 검증 (AC-1, AC-4)."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+
+
+# REQ-016 AC-1: codebase에 issue_client_token / CreateClientTokenRequest / IssuedClientTokenResponse 잔여 없음
+
+def test_no_issue_client_token_symbol_in_codebase() -> None:
+    result = subprocess.run(
+        ["grep", "-r", "--include=*.py", "-l", "issue_client_token"],
+        capture_output=True,
+        text=True,
+        cwd=str(__import__("pathlib").Path(__file__).parent.parent),
+    )
+    matches = [line for line in result.stdout.splitlines() if not line.startswith("tests/test_auth_surface")]
+    assert matches == [], f"issue_client_token 잔여 참조 발견: {matches}"
+
+
+def test_no_create_client_token_request_symbol_in_codebase() -> None:
+    result = subprocess.run(
+        ["grep", "-r", "--include=*.py", "-l", "CreateClientTokenRequest"],
+        capture_output=True,
+        text=True,
+        cwd=str(__import__("pathlib").Path(__file__).parent.parent),
+    )
+    matches = [line for line in result.stdout.splitlines() if not line.startswith("tests/test_auth_surface")]
+    assert matches == [], f"CreateClientTokenRequest 잔여 참조 발견: {matches}"
+
+
+def test_no_issued_client_token_response_symbol_in_codebase() -> None:
+    result = subprocess.run(
+        ["grep", "-r", "--include=*.py", "-l", "IssuedClientTokenResponse"],
+        capture_output=True,
+        text=True,
+        cwd=str(__import__("pathlib").Path(__file__).parent.parent),
+    )
+    matches = [line for line in result.stdout.splitlines() if not line.startswith("tests/test_auth_surface")]
+    assert matches == [], f"IssuedClientTokenResponse 잔여 참조 발견: {matches}"
+
+
+# REQ-016 AC-4: dcy-003 token_type 게이트 — client token 발급 불가에 따른 회귀 없음
+# (token_type='client' 게이트 자체는 유지: dcy-003 OQ-5)
+
+def test_client_token_type_not_importable_from_auth_service() -> None:
+    import importlib
+    module = importlib.import_module("app.services.auth_service")
+    assert not hasattr(module, "IssuedClientToken"), "IssuedClientToken이 auth_service에 잔존합니다"
+    assert not hasattr(module.AuthService, "issue_client_token"), "issue_client_token 메서드가 잔존합니다"
+
+
+def test_client_token_request_not_importable_from_schemas() -> None:
+    import importlib
+    module = importlib.import_module("app.schemas.auth")
+    assert not hasattr(module, "CreateClientTokenRequest"), "CreateClientTokenRequest가 schemas/auth에 잔존합니다"
+    assert not hasattr(module, "IssuedClientTokenResponse"), "IssuedClientTokenResponse가 schemas/auth에 잔존합니다"