feat(V1-API): implement TREX-Basic consumer API contract with encryption and persistence

- Add V1 API endpoints: assets, ledger, user-info
- Implement Fernet-based credential payload encryption (req-010)
- Extend health response schema with runtime info (req-004)
- Add service token runtime ID issuance (req-005)
- Implement database schema migration for V1 API (req-009)
- Add comprehensive test coverage for V1 endpoints
- Update SRS with 10 new requirements (REQ-004 through REQ-011)
- Create batch planning, design, and verification for BAT-001
- Integrate review-discovery StagePilot skill
- Update documentation indices and baseline specs

app/services/auth_service.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import uuid
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 
@@ -131,6 +132,7 @@ class AuthService:
             expires_at = datetime.now(timezone.utc) + timedelta(days=days)
 
         raw_token = generate_token()
+        runtime_id = str(uuid.uuid4())
         try:
             auth_token = self._repository.create_auth_token(
                 user.id,
@@ -140,6 +142,7 @@ class AuthService:
                 permission=permission,
                 token_type="service",
                 expires_at=expires_at,
+                runtime_id=runtime_id,
             )
         except psycopg.errors.UniqueViolation as exc:
             raise ValueError(f"이미 존재하는 서비스 토큰 이름입니다: {name}") from exc