feat: add staged subscription rollout mode

apps/licensing/admin.py

@@ -28,6 +28,13 @@ from .services import (
 )
 
 
+class HiddenFromAdminIndexMixin:
+    """Keep registered models addressable without adding menu noise."""
+
+    def get_model_perms(self, request):
+        return {}
+
+
 def _masked_fingerprint(value: str) -> str:
     if not value:
         return ""
@@ -35,7 +42,7 @@ def _masked_fingerprint(value: str) -> str:
 
 
 @admin.register(ClientDevice)
-class ClientDeviceAdmin(admin.ModelAdmin):
+class ClientDeviceAdmin(HiddenFromAdminIndexMixin, admin.ModelAdmin):
     list_display = (
         "user",
         "product_code",
@@ -81,7 +88,7 @@ class ClientDeviceAdmin(admin.ModelAdmin):
 
 
 @admin.register(DeviceSession)
-class DeviceSessionAdmin(admin.ModelAdmin):
+class DeviceSessionAdmin(HiddenFromAdminIndexMixin, admin.ModelAdmin):
     list_display = ("device", "expires_at", "last_used_at", "revoked_at", "created_at")
     list_filter = ("revoked_at", "expires_at")
     search_fields = ("device__user__username", "device__user__email")
@@ -106,7 +113,7 @@ class DeviceSessionAdmin(admin.ModelAdmin):
 
 
 @admin.register(DeviceBindingAudit)
-class DeviceBindingAuditAdmin(admin.ModelAdmin):
+class DeviceBindingAuditAdmin(HiddenFromAdminIndexMixin, admin.ModelAdmin):
     list_display = ("user", "device", "api_key", "action", "reason", "created_at")
     list_filter = ("action", "created_at")
     search_fields = ("user__username", "user__email", "api_key__key_prefix")
@@ -334,15 +341,12 @@ class ReadOnlyLicenseAdmin(admin.ModelAdmin):
         return False
 
 
-class HiddenLegacyLicenseAdmin(ReadOnlyLicenseAdmin):
-    """Keep legacy records addressable without advertising them in admin."""
-
-    def get_model_perms(self, request):
-        return {}
+class HiddenLicenseAdmin(HiddenFromAdminIndexMixin, ReadOnlyLicenseAdmin):
+    pass
 
 
 @admin.register(LicenseSeat)
-class LicenseSeatAdmin(HiddenLegacyLicenseAdmin):
+class LicenseSeatAdmin(HiddenLicenseAdmin):
     list_display = ("entitlement", "seat_number", "device", "bound_at", "released_at")
     list_filter = ("entitlement__product_code", "bound_at", "released_at")
     search_fields = (
@@ -354,7 +358,7 @@ class LicenseSeatAdmin(HiddenLegacyLicenseAdmin):
 
 
 @admin.register(LicenseEvent)
-class LicenseEventAdmin(ReadOnlyLicenseAdmin):
+class LicenseEventAdmin(HiddenLicenseAdmin):
     list_display = ("entitlement", "action", "seat", "device", "actor", "reason", "created_at")
     list_filter = ("action", "entitlement__product_code", "created_at")
     search_fields = (
@@ -370,7 +374,7 @@ class LegacyMigrationGrantForm(EntitlementGrantForm):
 
 
 @admin.register(LegacyMigrationGrant)
-class LegacyMigrationGrantAdmin(HiddenLegacyLicenseAdmin):
+class LegacyMigrationGrantAdmin(HiddenLicenseAdmin):
     list_display = ("user", "product_code", "entitlement", "status", "actor", "created_at")
     list_filter = ("product_code", "status", "created_at")
     search_fields = ("user__username", "user__email", "reason")
@@ -417,7 +421,7 @@ class LegacyMigrationGrantAdmin(HiddenLegacyLicenseAdmin):
 
 
 @admin.register(MigrationRequest)
-class MigrationRequestAdmin(HiddenLegacyLicenseAdmin):
+class MigrationRequestAdmin(HiddenLicenseAdmin):
     list_display = ("request_id", "user", "device", "migration_grant", "status", "expires_at", "confirmed_at")
     list_filter = ("status", "device__product_code", "expires_at")
     search_fields = ("=request_id", "user__username", "user__email")
@@ -425,7 +429,7 @@ class MigrationRequestAdmin(HiddenLegacyLicenseAdmin):
 
 
 @admin.register(DeviceCredential)
-class DeviceCredentialAdmin(HiddenLegacyLicenseAdmin):
+class DeviceCredentialAdmin(HiddenLicenseAdmin):
     list_display = ("token_prefix", "user", "product_code", "device", "entitlement", "expires_at", "revoked_at")
     list_filter = ("product_code", "revoked_at", "expires_at")
     search_fields = ("token_prefix", "user__username", "user__email")
@@ -433,7 +437,7 @@ class DeviceCredentialAdmin(HiddenLegacyLicenseAdmin):
 
 
 @admin.register(SoftwareOrder)
-class SoftwareOrderAdmin(ReadOnlyLicenseAdmin):
+class SoftwareOrderAdmin(HiddenLicenseAdmin):
     list_display = (
         "created_at",
         "order_no",