feat(12-01): schema nullable oidc identity + claimed marker + 0002 migration

- Remove .notNull() from users.oidc_iss and users.oidc_sub (wizard creates
  local rows before OIDC identity is known; first-login-claims binds later)
- Add users.claimed boolean (default false NOT NULL) to distinguish pending
  wizard rows from OIDC-bound rows (D-07)
- Add Phase 12 app_config key documentation + prohibition comment (D-01/SC-3)
- Generate migration 0002_lethal_millenium_guard.sql via drizzle-kit generate
  (MODIFY COLUMN for nullable, ADD COLUMN claimed — no DROP/recreate)
- Append backfill: UPDATE users SET claimed=true WHERE oidc_iss IS NOT NULL
  so existing OIDC users cannot be matched by first-login-claims (D-08)
- Apply migration via drizzle-kit migrate — users.claimed column verified in dev DB

apps/api/src/db/migrations/0002_lethal_millenium_guard.sql

@@ -0,0 +1,7 @@
+ALTER TABLE `users` MODIFY COLUMN `oidc_iss` varchar(512);--> statement-breakpoint
+ALTER TABLE `users` MODIFY COLUMN `oidc_sub` varchar(256);--> statement-breakpoint
+ALTER TABLE `users` ADD `claimed` boolean DEFAULT false NOT NULL;
+--> statement-breakpoint
+-- Phase 12 backfill (D-07): existing OIDC users are effectively claimed —
+-- prevents first-login-claims (D-08) from matching rows that already have an identity bound.
+UPDATE `users` SET `claimed` = true WHERE `oidc_iss` IS NOT NULL;

apps/api/src/db/migrations/meta/_journal.json

@@ -15,6 +15,13 @@
       "when": 1781374816375,
       "tag": "0001_famous_mad_thinker",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "5",
+      "when": 1781545048917,
+      "tag": "0002_lethal_millenium_guard",
+      "breakpoints": true
     }
   ]
 }