feat(admin): add audited Refine staging console

2026-07-28 09:47:13 +08:00
parent 43581ac0f7
commit 02ec5db361
35 changed files with 4545 additions and 272 deletions
@@ -0,0 +1,6 @@
+-- Admin-host sessions may be created for read-only viewers. API authorization
+-- remains server-side and is resolved from this persisted role on every request.
+-- Existing identity migrations already grant admin_runtime these reads; repeat the
+-- least-privilege user grant so drifted staging databases fail closed at login.
+
+grant select on table identity.users to admin_runtime;