feat: implement T-019 reliable event ingress

deploy/postgres/017_privileges_event_ingress.sql

@@ -0,0 +1,25 @@
+-- Bell runtime may read controlled identity bindings, append events/source
+-- receipts and maintain only short-lived nonce receipts.
+
+REVOKE ALL ON TABLE bell.event_ingress_bindings,
+    bell.event_ingress_receipts, bell.event_ingress_nonces FROM PUBLIC;
+REVOKE ALL ON TABLE bell.event_ingress_bindings,
+    bell.event_ingress_receipts, bell.event_ingress_nonces FROM bell_runtime;
+
+GRANT SELECT ON TABLE bell.event_ingress_bindings TO bell_runtime;
+GRANT SELECT, INSERT ON TABLE bell.event_ingress_receipts TO bell_runtime;
+GRANT SELECT, INSERT, DELETE ON TABLE bell.event_ingress_nonces TO bell_runtime;
+
+-- Column grants deliberately exclude endpoint_ref, credential_ref,
+-- profile_token and path_name.
+GRANT USAGE ON SCHEMA sense TO bell_runtime;
+REVOKE ALL ON TABLE sense.devices FROM bell_runtime;
+GRANT SELECT (id, tenant_id, site_id, area_id, modality)
+    ON TABLE sense.devices TO bell_runtime;
+GRANT SELECT (tenant_id, id, deleted_at)
+    ON TABLE bell.sites TO bell_runtime;
+GRANT SELECT (tenant_id, site_id, id, capture_policy, deleted_at)
+    ON TABLE bell.areas TO bell_runtime;
+
+REVOKE ALL ON TABLE bell.event_ingress_bindings,
+    bell.event_ingress_receipts, bell.event_ingress_nonces FROM sense_app;