feat: implement daemon model with registry and single-asset assignment (BAT-010, REQ-023/028)

Core Implementation (BAT-010):
- Add daemon registry schema and CRUD operations (req-023)
- Implement single-daemon asset assignment constraint (one asset per daemon)
- Add daemon_id field to service_token for daemon identification
- Add daemon.py CLI module for daemon management commands
- Add 20260513_0016_daemon_model.py migration for daemon tables

API Changes:
- GET /v1/assets: include daemon_id in AssetResponse
- POST /v1/assets/{asset_id}/ledger/trades: require daemon token binding
- GET /v1/user_info: include daemon metadata
- Enhanced service-token rotate to preserve daemon bindings

CLI Commands:
- pfhub daemon register --name <name> --runtime-id <runtime-id>
- pfhub daemon list
- pfhub daemon get <daemon-id>
- pfhub daemon revoke <daemon-id>

Requirements (REQ-023, REQ-028):
- REQ-023: Daemon Registry and Service Token Daemon Binding (Interface, Approved)
  * AC-1: daemon CRUD operations
  * AC-2: service token daemon binding for POST /v1/assets/{asset_id}/ledger/trades
  * AC-3: single daemon per asset (exact-one assignment model)
- REQ-028: README.md Daemon Provisioning Runbook update (Documentation, Approved)

Documentation:
- Add dcy-006 Discovery for daemon-id and single-daemon asset assignment
- Update README.md with Daemon Provisioning Runbook section
- Add BAT-010 batch documentation with planning, implementation, verification
- Update rel-006 release document (daemon model implementation)
- Update data-model.md with daemon and daemon_asset_assignment tables
- Update interface-contract.md with daemon registry APIs
- Update runtime-flows.md with daemon lifecycle flows

Breaking Changes:
- REQ-005~009, REQ-011~012 status reverted to Approved due to revised contract
  * daemon_id field addition and exact-one asset assignment requirement
  * Existing Implemented evidence invalidated by contract revision
  * BAT-001/002/008 re-verification required

Testing:
- Add test_daemon_registry.py for daemon CRUD operations
- Add test_daemon_assignment.py for single-asset assignment constraints
- Update test_auth.py, test_cli.py, test_v1.py for daemon support
- Verify daemon token binding in trade endpoint authorization

Impact:
- Database: 2 new tables (daemons, daemon_asset_assignments)
- Migration: 20260513_0016 creates daemon model schema
- CLI: 4 new daemon subcommands
- API: daemon_id propagation through v1 endpoints
- Verification: BAT-001/002/008 re-verification gates next release

app/services/auth_service.py

@@ -117,11 +117,19 @@ class AuthService:
         permission: str = "read",
         expires_in_days: int | None = None,
         no_expiry: bool = False,
+        daemon_id: str | None = None,
     ) -> IssuedServiceToken:
         user = self._repository.get_user_by_username(username)
         if user is None:
             raise ValueError(f"사용자를 찾을 수 없습니다: {username}")
 
+        if daemon_id is not None:
+            daemon = self._repository.get_daemon_by_id(daemon_id)
+            if daemon is None or not daemon.is_active:
+                raise ValueError(f"존재하지 않거나 비활성 데몬입니다: {daemon_id}")
+            if daemon.owner_user_id != user.id:
+                raise ValueError("데몬이 해당 사용자에 속하지 않습니다")
+
         expires_at: datetime | None
         if no_expiry:
             if expires_in_days is not None:
@@ -143,11 +151,16 @@ class AuthService:
                 token_type="service",
                 expires_at=expires_at,
                 runtime_id=runtime_id,
+                daemon_id=daemon_id,
             )
         except psycopg.errors.UniqueViolation as exc:
             raise ValueError(f"이미 존재하는 서비스 토큰 이름입니다: {name}") from exc
         return IssuedServiceToken(token=raw_token, auth_token=auth_token)
 
+    def rotate_service_token(self, name: str) -> IssuedServiceToken:
+        raw_token, auth_token = self._repository.rotate_service_token(name)
+        return IssuedServiceToken(token=raw_token, auth_token=auth_token)
+
     def revoke_service_token(self, name: str) -> datetime:
         existing = self._repository.get_service_token_by_name(name)
         if existing is None: