feat: complete Epic 1 production foundation

crates/crank-registry/src/migrations/schema_guard_v8.rs

@@ -0,0 +1,27 @@
+use sqlx::PgConnection;
+
+use super::authority::MigrationError;
+use super::schema_guard::{column_exists, relation_exists, schema_error};
+
+pub(super) async fn validate_v8_admin_auth_lifecycle(
+    connection: &mut PgConnection,
+) -> Result<(), MigrationError> {
+    for relation in [
+        "admin_bootstrap_contracts",
+        "admin_bootstrap_contracts_single_active_idx",
+        "admin_bootstrap_contracts_token_hash_idx",
+        "admin_login_backoff",
+        "admin_security_audit_events",
+        "admin_security_audit_events_created_idx",
+    ] {
+        if !relation_exists(connection, relation).await? {
+            return Err(schema_error(8));
+        }
+    }
+    for column in ["csrf_hash", "revoked_at"] {
+        if !column_exists(connection, "user_sessions", column).await? {
+            return Err(schema_error(8));
+        }
+    }
+    Ok(())
+}