feat(m2m): ServiceAccount + TrustedIssuer schemas, storage interface, M2M constants [Phase 1 — PR 1/5]

[lakhansamani]

Summary

Establishes the foundational storage layer for the Workload Identity Program — a 6-phase initiative adding machine/service authentication to Authorizer.

This is PR 1 of 5 for Phase 1 (client credentials grant). Nothing in this PR breaks existing flows; it is purely additive.

Spec: docs/specs/WORKLOAD_IDENTITY_PROGRAM.md

What's in this PR

New schemas (internal/storage/schemas/)

• ServiceAccount — machine/workload OAuth2 client. ID = client_id, ClientSecret = bcrypt hash. No email, MFA, social login, or session fields — those belong to User. Deliberately separate per industry standard (Auth0, Okta, GCP, Keycloak all keep machine identity distinct from human users).
• TrustedIssuer — external JWT issuer registry. Carries all fields needed for all 6 phases: KeySourceType, ExpectedAud, EnableTokenReview (K8s online validation, Phase 4), SpiffeRefreshHintSeconds (SPIFFE bundle refresh cadence, Phase 5), AuthMethod + proxy fields (X.509 mTLS, Phase 6). Schema defined once now to avoid the all-DB-tax of multiple migrations.

Collections (schemas/model.go)

• authorizer_service_accounts
• authorizer_trusted_issuers

Storage interface (storage/provider.go)

• 5 ServiceAccount methods: Add, Update, Delete, GetByID, List
• 6 TrustedIssuer methods: Add, Update, Delete, GetByID, GetByIssuerURL, List

SQL provider (storage/db/sql/) — full GORM implementation

• service_account.go — CRUD following webhook.go pattern
• trusted_issuer.go — CRUD with indexed GetByIssuerURL (hot path: called on every client_assertion validation)
• provider.go — AutoMigrate extended with both new entities

NoSQL providers (mongodb, arangodb, cassandradb, dynamodb, couchbase)

• Stubs returning "not implemented" errors so the build compiles
• Replaced with full implementations in PR 2/5

Constants (internal/constants/grant_types.go)

• RFC 6749/8693 grant types: client_credentials, token exchange URN
• RFC 7521/7523 client assertion types: jwt-bearer, jwt-spiffe (preview)
• RFC 8693 token type URNs
• KeySourceType, IssuerType, AuthMethod string constants

Audit events (internal/constants/audit_event.go)

• admin.service_account_{created,updated,deleted,secret_rotated}
• admin.trusted_issuer_{created,updated,deleted}
• token.client_credentials, token.exchange, token.workload_auth

PR chain

PR 1 (this) — schema + interface + SQL + constants  →  main
PR 2         — NoSQL provider implementations        →  PR 1
PR 3         — service layer + admin GraphQL API     →  PR 2
PR 4         — gRPC admin RPCs                       →  PR 3
PR 5         — client_credentials grant + tests      →  PR 4

Reviewer checklist

• ServiceAccount struct tags correct across all 6 DB tag formats (json, bson, cql, dynamo, gorm)
• TrustedIssuer struct tags correct; all Phase 4/5/6 fields present
• gorm:"default:true" on IsActive, gorm:"default:'jwt_assertion'" on AuthMethod
• SQL GetTrustedIssuerByIssuerURL uses WHERE issuer_url = ? (indexed — this is the hot path)
• No client_secret exposure path in ServiceAccount (no AsAPIServiceAccount in this PR — that's PR 3)
• NoSQL stubs all return "not implemented" errors (not panics)
• AutoMigrate includes both new types
• CollectionList and Collections consistent

Test plan

• go build ./... passes (verified locally — clean)
• go vet ./... passes (verified locally — clean)
• make test-sqlite passes (no new tests in this PR; existing tests unaffected — schema addition is additive)