Add auth and audit database migration

scripts/migrate-auth-audit-db.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DB_FILE="/opt/appfactory/data/appfactory/appfactory.db"
+
+if [ ! -f "$DB_FILE" ]; then
+  echo "Missing database: $DB_FILE"
+  exit 1
+fi
+
+python3 - "$DB_FILE" <<'PY'
+import sqlite3
+import sys
+
+db_file = sys.argv[1]
+
+con = sqlite3.connect(db_file)
+
+con.execute("""
+CREATE TABLE IF NOT EXISTS users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    username TEXT NOT NULL UNIQUE,
+    display_name TEXT NOT NULL,
+    email TEXT,
+    password_hash TEXT,
+    role TEXT NOT NULL DEFAULT 'admin',
+    is_active INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+)
+""")
+
+con.execute("""
+CREATE TABLE IF NOT EXISTS audit_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER,
+    username TEXT,
+    action TEXT NOT NULL,
+    target_type TEXT NOT NULL,
+    target_id TEXT,
+    source TEXT NOT NULL DEFAULT 'portal',
+    metadata TEXT,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+)
+""")
+
+columns = [row[1] for row in con.execute("PRAGMA table_info(deployments)").fetchall()]
+
+if "trigger_source" not in columns:
+    con.execute("ALTER TABLE deployments ADD COLUMN trigger_source TEXT DEFAULT 'unknown'")
+
+if "triggered_by_user_id" not in columns:
+    con.execute("ALTER TABLE deployments ADD COLUMN triggered_by_user_id INTEGER")
+
+if "triggered_by_username" not in columns:
+    con.execute("ALTER TABLE deployments ADD COLUMN triggered_by_username TEXT")
+
+if "triggered_by_display_name" not in columns:
+    con.execute("ALTER TABLE deployments ADD COLUMN triggered_by_display_name TEXT")
+
+if "commit_author" not in columns:
+    con.execute("ALTER TABLE deployments ADD COLUMN commit_author TEXT")
+
+if "pusher" not in columns:
+    con.execute("ALTER TABLE deployments ADD COLUMN pusher TEXT")
+
+con.execute("""
+INSERT INTO users (
+    username,
+    display_name,
+    email,
+    role,
+    is_active
+)
+SELECT
+    'admin',
+    'Administrator',
+    NULL,
+    'admin',
+    1
+WHERE NOT EXISTS (
+    SELECT 1 FROM users WHERE username = 'admin'
+)
+""")
+
+con.commit()
+
+print("Auth/audit migration completed.")
+print("")
+print("Tables:")
+for row in con.execute("SELECT name FROM sqlite_master WHERE type='table' ORDER BY name"):
+    print(f"- {row[0]}")
+
+con.close()
+PY