refactor(server): move the access handlers' SQL into repositories

[fylorn]

Next per-domain PR after #45 taking SQL out of crates/server/src/handlers. This one covers access: api_keys.rs (18 statements), auth.rs (17), setup.rs (7), sso.rs (3), admin/oidc.rs (2), admin/settings.rs (1) — 48 in all. None of these handlers carries SQL any more.

What moved

• services::api_key_repository — api_keys: owner lookup, live lookup, the list (count + page, all users or one, live or revoke-archived), insert, the PATCH update, revoke / force-revoke, rotation (its transaction now lives here), expiring keys, cost centers; plus the mcp_user_credentials check behind mcp_account_overrides.
• services::auth_repository — what login, registration, /me, password change, TOTP, account deletion and SSO read and write: user lookups (by email, id, OIDC identity), the recovery-code compare-and-swap, the registration insert (on the handler's transaction), the SSO insert, the default-role assignment (shared by registration and SSO; takes any executor), teams and role assignments for /me, and the account soft-delete transaction.
• services::setup_repository — the first-boot wizard: advisory lock, the DB setup.initialized read, and the admin + key + settings writes, all on the handler's transaction (it still holds the lock across validation and hashing, as before).
• services::settings_repository — deleting the OIDC draft, and the role-exists check behind auth.default_role.

Statements are carried over verbatim with the same binds and fetch kinds. The one textual difference: the default-role INSERT … SELECT was written twice (register, SSO) with different indentation and is now one function. Handlers keep permission checks, validation, audit, Redis / session / cache work and response shaping. No row types needed moving (the queries return ApiKey, User and tuples); openapi.rs is unchanged.

No behaviour change — checked

crates/test-support/tests/admin_access.rs adds integration tests for what no test reached:

• keys: create (surface normalisation, cost-center trim, lineage root) / get / PATCH set-vs-clear-vs-absent semantics and every 400 branch, 404s; the default expiry / rotation settings on create; list paging, own-vs-all, revoke, force-revoke, and the archived view (which excludes keys soft-deleted with their account); expiring keys (window, clamp, own-vs-all); cost centers; policy scope;
• auth: auth.default_role validation, registration assigning the default role, duplicate registration, /me role assignments and teams order, TOTP status;
• SSO against a mock identity provider (wiremock + an RS256 test key; jsonwebtoken added as a test-support dev-dependency): wizard activation (draft dropped), first sign-in provisioning with normalised email and default role, re-sign-in to the same row, the placeholder email for an identity without one, deactivated / deleted accounts refused.

They pass against the code before this change and after it. Login, refresh, password change, TOTP setup / disable / recovery, account deletion, setup and rotation were already covered (auth.rs, totp_recovery.rs, setup_wizard_e2e.rs, api_key_rotation.rs, oidc_wizard.rs, …) and pass too.

Checks

fmt, clippy (--all-targets, --lib), 687 unit tests, full integration suite on own containers (293 passed).

🤖 Generated with Claude Code