Merge remote-tracking branch 'origin/pr/399' into aether-rust-pioneer

# Conflicts:
#	crates/aether-data/src/lifecycle/bootstrap/postgres.rs
#	crates/aether-data/src/lifecycle/migrate/tests.rs

crates/aether-data/schema/generated/mysql/baseline/001_identity.sql

@@ -117,6 +117,7 @@ CREATE TABLE IF NOT EXISTS management_tokens (
     `token_hash` VARCHAR(255) NOT NULL,
     `token_prefix` VARCHAR(64),
     `allowed_ips` JSON,
+    `permissions` JSON,
     `expires_at` BIGINT,
     `last_used_at` BIGINT,
     `last_used_ip` VARCHAR(255),

crates/aether-data/schema/generated/postgres/baseline/001_identity.sql

@@ -122,6 +122,7 @@ CREATE TABLE IF NOT EXISTS public.management_tokens (
     token_hash character varying(255) NOT NULL,
     token_prefix character varying(64),
     allowed_ips jsonb,
+    permissions jsonb,
     expires_at bigint,
     last_used_at bigint,
     last_used_ip character varying(255),

crates/aether-data/schema/generated/sqlite/baseline/001_identity.sql

@@ -112,6 +112,7 @@ CREATE TABLE IF NOT EXISTS management_tokens (
     token_hash TEXT NOT NULL,
     token_prefix TEXT,
     allowed_ips TEXT,
+    permissions TEXT,
     expires_at INTEGER,
     last_used_at INTEGER,
     last_used_ip TEXT,

crates/aether-data/schema/logical/001_identity.toml

@@ -499,6 +499,11 @@ name = "allowed_ips"
 type = "json"
 nullable = true
 
+[[table.management_tokens.columns]]
+name = "permissions"
+type = "json"
+nullable = true
+
 [[table.management_tokens.columns]]
 name = "expires_at"
 type = "unix_seconds"