feat: dcy-003/004 토큰 surface 개편 및 daemon lifecycle 정책 구현 (BAT-006/007)

BAT-006 (REQ-016/017/018):
- client token 발급 경로 제거 (issue_client_token, POST /auth/tokens, 관련 스키마/테스트)
- service-token rotate unique index revoked_at IS NULL 조건 추가 (Alembic CONCURRENTLY 마이그레이션)
- POST /auth/service-tokens body daemon_id forward 누락 보정 (1-line fix)

BAT-007 (REQ-022/023):
- daemon deactivate 시 바인딩 service token 자동 revoke (CLI --force 옵션 + revoke_tokens_by_daemon_id)
- NULL daemon_id legacy token 진단 CLI (migrate-null-daemon --dry-run)

거버넌스 문서: dcy-003/004 Discovery, REQ-016~023/025~032 신규, BAT-006/007 전체 산출물

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_daemon_registry.py

@@ -160,6 +160,20 @@ class _DaemonRepo:
         existing.daemon_id = daemon_id
         return existing
 
+    def revoke_tokens_by_daemon_id(self, daemon_id: str) -> int:
+        count = 0
+        for token in self._tokens.values():
+            if token.daemon_id == daemon_id and token.revoked_at is None:
+                token.revoked_at = datetime.now(timezone.utc)
+                count += 1
+        return count
+
+    def list_service_tokens_with_null_daemon(self) -> list[AuthToken]:
+        return [
+            t for t in self._tokens.values()
+            if t.token_type == "service" and t.daemon_id is None and t.revoked_at is None
+        ]
+
 
 def _repo_with_user(username: str = "alice") -> _DaemonRepo:
     repo = _DaemonRepo()
@@ -329,3 +343,73 @@ def test_rebind_service_token_rejects_daemon_from_other_user() -> None:
 
     with pytest.raises(ValueError, match="해당 토큰 사용자에 속하지 않습니다"):
         service.rebind_service_token("my-token", foreign_daemon.id)
+
+
+# ---------------------------------------------------------------------------
+# REQ-022: daemon deactivation 시 바인딩 service token 자동 revoke
+# ---------------------------------------------------------------------------
+
+def test_deactivate_daemon_revokes_bound_tokens() -> None:
+    repo = _repo_with_user()
+    daemon = repo.create_daemon("user-1", daemon_slug="alpha-bot")
+    service = _service(repo)
+    issued = service.issue_service_token("tok1", "alice", daemon_id=daemon.id, no_expiry=True)
+
+    repo.update_daemon(daemon.id, is_active=False)
+    revoked_count = repo.revoke_tokens_by_daemon_id(daemon.id)
+
+    assert revoked_count == 1
+    assert repo._tokens[issued.auth_token.id].revoked_at is not None
+    assert not repo._daemons[daemon.id].is_active
+
+
+def test_deactivate_daemon_revokes_multiple_bound_tokens() -> None:
+    repo = _repo_with_user()
+    daemon = repo.create_daemon("user-1", daemon_slug="alpha-bot")
+    service = _service(repo)
+    issued1 = service.issue_service_token("tok1", "alice", daemon_id=daemon.id, no_expiry=True)
+    issued2 = service.issue_service_token("tok2", "alice", daemon_id=daemon.id, no_expiry=True)
+
+    repo.update_daemon(daemon.id, is_active=False)
+    revoked_count = repo.revoke_tokens_by_daemon_id(daemon.id)
+
+    assert revoked_count == 2
+    assert repo._tokens[issued1.auth_token.id].revoked_at is not None
+    assert repo._tokens[issued2.auth_token.id].revoked_at is not None
+
+
+def test_deactivate_daemon_with_no_tokens_is_noop() -> None:
+    repo = _repo_with_user()
+    daemon = repo.create_daemon("user-1", daemon_slug="alpha-bot")
+
+    repo.update_daemon(daemon.id, is_active=False)
+    revoked_count = repo.revoke_tokens_by_daemon_id(daemon.id)
+
+    assert revoked_count == 0
+    assert not repo._daemons[daemon.id].is_active
+
+
+def test_reactivate_daemon_does_not_unrevoke_tokens() -> None:
+    repo = _repo_with_user()
+    daemon = repo.create_daemon("user-1", daemon_slug="alpha-bot")
+    service = _service(repo)
+    issued = service.issue_service_token("tok1", "alice", daemon_id=daemon.id, no_expiry=True)
+
+    repo.update_daemon(daemon.id, is_active=False)
+    repo.revoke_tokens_by_daemon_id(daemon.id)
+    repo.update_daemon(daemon.id, is_active=True)
+
+    assert repo._daemons[daemon.id].is_active
+    assert repo._tokens[issued.auth_token.id].revoked_at is not None
+
+
+def test_revoke_tokens_for_daemon_via_service() -> None:
+    repo = _repo_with_user()
+    daemon = repo.create_daemon("user-1", daemon_slug="alpha-bot")
+    service = _service(repo)
+    issued = service.issue_service_token("tok1", "alice", daemon_id=daemon.id, no_expiry=True)
+
+    count = service.revoke_tokens_for_daemon(daemon.id)
+
+    assert count == 1
+    assert repo._tokens[issued.auth_token.id].revoked_at is not None