refactor(db): move API token store ownership

[TheSentinel454]

Current reconstructed head

Exact base: codex/issue-7-channel-membership-store at 8ad0782ee311f5f51b714494ce750c5937f127cc
Exact head: codex/issue-12-api-token-store at efd769903a0aab75961453ab247bef923f64ac38

This current head removes crates/buzz-db/tests/store_ownership.rs; no replacement path-sensitive ownership test is introduced. Apart from removing that complete test-file diff, the production patch is byte-for-byte identical to the previously reviewed slice. This remains part of tracker #2 and the #17/#19 acceptance work.

Independent exact-head review from a separate clean Blox workstation found no issues. Current-head evidence passed formatting, strict buzz-db clippy, 111 non-PostgreSQL library tests with 200 PostgreSQL tests ignored, the observability source test, relay consumer compilation, exact ownership/unique-span review checks, and 2 API-token PostgreSQL tests on native PostgreSQL where applicable.

Why

Complete the API-token half of tracker #2 and domain issue #12 while keeping Db as the stable public facade. This child stacks on the channel/membership extraction in #6782.

What

• Move ApiTokenRecord, TokenSummary, parse_api_token_row, every API-token Db method, inline SQL, focused tests, and datastore spans into api_token.rs
• Preserve every public Db signature and crate-root record export
• Preserve validation, JSON parsing, community scoping, token limits, revocation behavior, and the existing update_token_last_used alias-to-touch_api_token single-span behavior

Stack

• Exact base: codex/issue-7-channel-membership-store at 25138bf (#6782)
• Exact head: codex/issue-12-api-token-store at 7798ea8
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain: buzz-db: move misplaced types to domain modules TheSentinel454/buzz#12
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, validation, retry, timeout, transaction, or client-visible behavior changes
• No consolidation of authentication allowlisting with API tokens or NIP-43 relay membership
• No store traits, domain-handle redesign, broad PgExecutor migration, raw pool accessor, new crate, or directory-wide reorganization
• No changes to, retargeting of, or merge action on parent PRs or PR Add database pressure observability #6700

Risk Assessment

Low. This is a direct ownership move. The usage-update alias deliberately retains only the touch_api_token span to avoid nesting.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 677b81eea1c2c69e540670e907c3bda4a2993fd6.

• cargo fmt --all --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• Native PostgreSQL: cargo test -p buzz-db api_token::tests:: -- --ignored --test-threads=1 — 2 passed
• Relay public-path/all-target compilation is covered by the relay clippy invocation
• Commit-time formatting, sadscan, attribution, and sign-off hooks — passed

Independent exact-head review: buzz-tornquist-pr-6783-review (2048930) found no critical, important, or minor issues. The reviewer confirmed unchanged SQL/binds/validation/scoping and exactly one span per logical operation, including no alias span for update_token_last_used.

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

• Workstation: buzz-tornquist-pr-6783-final-review (2057621), fresh shallow checkout
• Base: fa09b6c81c4db3b3e1940a2117a97ab2186e49f7
• Head: e69f4e7180eae47d96c56012f9cbea966da584e2
• Findings: none

Reviewed API-token records, row parsing, SQL, Db wrappers, tests, and spans as a single move to api_token.rs. Community scoping, JSON/UUID validation errors, token limits, revocation behavior, and method signatures are unchanged. Crate-root type re-exports preserve established consumers. The uninstrumented alias continues to reuse touch_api_token so one logical operation produces one span.

Verification: format and diff checks passed; buzz-db --all-targets clippy passed with -D warnings; DB lib tests passed (111 passed, 200 PostgreSQL tests ignored); ownership (3/3) and observability (1/1) guards passed; both API-token PostgreSQL tests passed on native PostgreSQL 17 with migrations 1-32 successful; relay lib test target compiled successfully. Final worktree was detached at the exact head and clean.

Complete evidence archive SHA-256: a05380cbf4f9b1671bee1bdffe78ebae390c792b87e497233310e35d1f193fa8.

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: 25138bfd6588e046170dbdbc4ed953bdc3cf7ed1
• Exact head: 7798ea83fe393cdc457577bb09a4fd7546b9722b
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict Clippy, DB lib 111 passed / 200 ignored, current ownership/observability guards, 2 API-token PostgreSQL tests, and relay compilation.

[wpfleger96]

🤖 Combined review from three independent passes (two source reviews + one E2E test run at exact head efd7699): no findings.

• Pure ownership move: all API-token Db wrappers relocated into api_token.rs with signatures, SQL, bind order, revocation filters, the 10-active-token limit, and all span names byte-preserved (one body differs only by rustfmt line folding).
• pub use api_token::{ApiTokenRecord, TokenSummary} keeps the established root paths compiling; update_token_last_used correctly remains uninstrumented, delegating to instrumented touch_api_token (still one span, not two).
• The sadscan suppression on the moved test-only TEST_DB_URL matches the existing precedent in lib.rs.
• E2E: api_token::tests:: Postgres group 2/2 on a fresh fully-migrated database; cargo check -p buzz-relay passes.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is e76c81968b65b0755b83efdd59dc3375c59ddf40...b00f8e291ef4b1997a4824373a614423d8960047.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review b00f8e291ef4b1997a4824373a614423d8960047 to authorize a new review.
Any previous review applies only to its recorded range.

[TheSentinel454]

🤖 Superseded by #6987, which consolidates the remaining issue #2 store-extraction stack onto merged #6782. #6987 is an open draft at the independently reviewed exact head, and all exact-head CI checks are green. This PR remains available for review history; please continue review on #6987.