feat(09-02): implement exact backend identity migrations

- Add the admin jti table, reset cutoff, and Winter indexes without AutoMigrate
- Reapply the developer and publisher seed idempotently and allow repeated role codes

cabana/auth.go

@@ -21,40 +21,6 @@ const (
 	msgServerError        = "Server error"
 )
 
-// BackendUserRole is the Winter backend_user_roles row.
-type BackendUserRole struct {
-	ID          uint      `gorm:"column:id;primaryKey"`
-	Name        string    `gorm:"column:name"`
-	Code        string    `gorm:"column:code"`
-	Description string    `gorm:"column:description"`
-	Permissions string    `gorm:"column:permissions"`
-	IsSystem    bool      `gorm:"column:is_system"`
-	CreatedAt   time.Time `gorm:"column:created_at"`
-	UpdatedAt   time.Time `gorm:"column:updated_at"`
-}
-
-func (BackendUserRole) TableName() string { return "backend_user_roles" }
-
-// BackendUser is the Winter backend_users row. It is not a frontend user.
-type BackendUser struct {
-	ID          uint           `gorm:"column:id;primaryKey"`
-	FirstName   string         `gorm:"column:first_name"`
-	LastName    string         `gorm:"column:last_name"`
-	Login       string         `gorm:"column:login"`
-	Email       string         `gorm:"column:email"`
-	Password    string         `gorm:"column:password"`
-	IsActivated bool           `gorm:"column:is_activated"`
-	IsSuperuser bool           `gorm:"column:is_superuser"`
-	RoleID      *uint          `gorm:"column:role_id"`
-	LastLogin   *time.Time     `gorm:"column:last_login"`
-	CreatedAt   time.Time      `gorm:"column:created_at"`
-	UpdatedAt   time.Time      `gorm:"column:updated_at"`
-	DeletedAt   gorm.DeletedAt `gorm:"column:deleted_at"`
-	Role        BackendUserRole
-}
-
-func (BackendUser) TableName() string { return "backend_users" }
-
 // BackendUsers loads activated backend principals. It never reads frontend users.
 type BackendUsers struct {
 	DB *gorm.DB

cabana/contracts.go

@@ -4,11 +4,55 @@ import (
 	"encoding/json"
 	"net/http"
 	"strings"
+	"time"
 
 	"git.golem15.com/golem15/summercms/bouncer"
 	"git.golem15.com/golem15/summercms/pact"
+	"gorm.io/gorm"
 )
 
+// BackendUserRole is the Winter backend_user_roles row.
+type BackendUserRole struct {
+	ID          uint      `gorm:"column:id;primaryKey"`
+	Name        string    `gorm:"column:name"`
+	Code        string    `gorm:"column:code"`
+	Description string    `gorm:"column:description"`
+	Permissions string    `gorm:"column:permissions"`
+	IsSystem    bool      `gorm:"column:is_system"`
+	CreatedAt   time.Time `gorm:"column:created_at"`
+	UpdatedAt   time.Time `gorm:"column:updated_at"`
+}
+
+func (BackendUserRole) TableName() string { return "backend_user_roles" }
+
+// BackendUser is the Winter backend_users row. It is not a frontend user.
+// Nullable Winter columns are mapped so a copied row round-trips without a
+// schema transform. TokensValidAfter is the admin reset cutoff, not a Winter column.
+type BackendUser struct {
+	ID                uint           `gorm:"column:id;primaryKey"`
+	FirstName         string         `gorm:"column:first_name"`
+	LastName          string         `gorm:"column:last_name"`
+	Login             string         `gorm:"column:login"`
+	Email             string         `gorm:"column:email"`
+	Password          string         `gorm:"column:password"`
+	ActivationCode    string         `gorm:"column:activation_code"`
+	PersistCode       string         `gorm:"column:persist_code"`
+	ResetPasswordCode string         `gorm:"column:reset_password_code"`
+	Permissions       string         `gorm:"column:permissions"`
+	IsActivated       bool           `gorm:"column:is_activated"`
+	IsSuperuser       bool           `gorm:"column:is_superuser"`
+	RoleID            *uint          `gorm:"column:role_id"`
+	ActivatedAt       *time.Time     `gorm:"column:activated_at"`
+	LastLogin         *time.Time     `gorm:"column:last_login"`
+	CreatedAt         time.Time      `gorm:"column:created_at"`
+	UpdatedAt         time.Time      `gorm:"column:updated_at"`
+	DeletedAt         gorm.DeletedAt `gorm:"column:deleted_at"`
+	TokensValidAfter  *time.Time     `gorm:"column:tokens_valid_after"`
+	Role              BackendUserRole
+}
+
+func (BackendUser) TableName() string { return "backend_users" }
+
 // Option is a dropdown choice shared with later schema plans.
 type Option = pact.Option