feat(store): add Area admission and audit outbox [T-010]

tests/test_postgres_contract.py

@@ -24,8 +24,12 @@ def privilege_findings(text: str) -> list[str]:
     findings: list[str] = []
     if "grant select on table bell.site_quota_v1 to sense_app" not in value:
         findings.append("Sense SELECT grant on quota view is missing")
+    if "grant select on table bell.area_policy_v1 to sense_app" not in value:
+        findings.append("Sense SELECT grant on Area view is missing")
     if "revoke all on table bell.sites from sense_app" not in value:
         findings.append("Bell source table revoke is missing")
+    if "revoke all on table bell.areas from sense_app" not in value:
+        findings.append("Bell Area source table revoke is missing")
     if re.search(
         r"grant\s+(?:all(?:\s+privileges)?|insert|update|delete|truncate|references|trigger)"
         r"(?:\s*,\s*(?:insert|update|delete|truncate|references|trigger))*"
@@ -42,7 +46,15 @@ class PostgresContractTests(unittest.TestCase):
     def test_migration_sequence_is_complete_and_stable(self) -> None:
         names = [path.name for path in sorted(MIGRATION_ROOT.glob("[0-9][0-9][0-9]_*.sql"))]
         self.assertEqual(
-            ["001_roles.sql", "002_bell.sql", "003_sense.sql", "004_privileges.sql"],
+            [
+                "001_roles.sql",
+                "002_bell.sql",
+                "003_sense.sql",
+                "004_privileges.sql",
+                "005_area_policy.sql",
+                "006_device_operation_outbox.sql",
+                "007_privileges_area_audit.sql",
+            ],
             names,
         )
 
@@ -75,10 +87,15 @@ class PostgresContractTests(unittest.TestCase):
         self.assertIn("create table if not exists sense.site_quota_projection_state", text)
 
     def test_cross_schema_privileges_are_minimal(self) -> None:
-        self.assertEqual([], privilege_findings(migration_text("004_privileges.sql")))
+        privileges = migration_text("004_privileges.sql") + migration_text(
+            "007_privileges_area_audit.sql"
+        )
+        self.assertEqual([], privilege_findings(privileges))
 
     def test_privilege_validator_rejects_broad_or_source_access(self) -> None:
-        original = migration_text("004_privileges.sql")
+        original = migration_text("004_privileges.sql") + migration_text(
+            "007_privileges_area_audit.sql"
+        )
         changed = original + "\nGRANT ALL PRIVILEGES ON bell.sites TO sense_app;\n"
         self.assertTrue(privilege_findings(changed))
         changed = original + "\nGRANT SELECT ON bell.sites TO sense_app;\n"
@@ -90,7 +107,7 @@ class PostgresContractTests(unittest.TestCase):
             "initdb.exe",
             "pg_ctl.exe",
             "127.0.0.1",
-            "yovision-t009-pg-",
+            "yovision-t010-pg-",
             "YOVISION_TEST_POSTGRES_DSN",
             "Get-NetTCPConnection",
         ):