refactor(server): move the identity handlers' SQL into repositories - #47

Continues the repository migration started in #45, for the identity domain.

What moved

All 56 inline sqlx::query* statements in handlers/admin/users.rs (18), handlers/roles.rs (21) and handlers/teams.rs (17) now live in:

• services::user_repository (extended) — user listing (global / team-scoped), per-user role and team joins, create, display name / active flags, soft delete, the api_keys cascades, a user's rbac_role_assignments.
• services::role_repository (new) — rbac_roles CRUD and the role side of rbac_role_assignments (counts, members, reassign-on-delete). RoleRow and ROLE_SELECT move with it.
• services::team_repository (new) — teams, team_members, team_role_assignments. Team, TeamWithCountRow and TeamRoleRow move with their queries (openapi.rs imports Team from there).

Every statement is carried over verbatim (same text, binds, fetch kind) — checked mechanically by comparing the evaluated SQL literals before and after. Handlers keep permission checks, validation, the super-admin quorum guard, audit and cache invalidation. Transactions that compose several statements with the quorum lock stay in the handler and pass &mut PgConnection down. Where a handler maps or swallows the raw sqlx error (FK/unique constraint names, unwrap_or_default/unwrap_or(0), a logged cascade failure, the team-membership check's own message), the repository returns sqlx::Error so the mapping — and the absence of the From<sqlx::Error> log line — is unchanged.

user_repository loses its #![allow(dead_code)] landing-zone header: the unused get_active / find_email are deleted, and soft_delete now is the statement delete_user actually runs.

No behaviour change: evidence

New crates/test-support/tests/admin_identity.rs (12 tests) covers what the suite didn't reach: user search with LIKE wildcards, pagination, team-scoped user/team listings, create with global + team-scoped roles / generated password / 409 / unknown role / bad scope, admin can't grant super_admin, PATCH role replacement and self-guard, disable → keys user_disabled, delete → keys user_deleted, role create/rename/description null-vs-absent/system rename refused, role members with scopes, delete role with reassign (all 400/404 branches), role history via ClickHouse, team get/update/delete (409/400/404), member cap of 10 + idempotent re-add + inactive user 404 + deleted users hidden, member self-read without teams:read, team role assign/list/remove.

The new tests pass against the original code (run before the move) and after it.

Checks

• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo clippy --workspace --lib -- -D warnings
• cargo nextest run --workspace --lib --bins --tests — 687 passed
• Full integration suite on local containers — 298/299; the one failure, streaming_and_cache::streaming_client_disconnect_emits_cancelled_gateway_log ("cancelled row never landed"), is a gateway timing test that passes when rerun alone and doesn't touch these handlers.

🤖 Generated with Claude Code