fix: Grant DELETE on notification_types to app DB roles (migration 0106)

unified_search plugin activation calls sync_notification_types() which
DELETEs stale rows from notification_types. App DB user (crm_api) lacked
DELETE permission, causing plugin activation to fail with
InsufficientPrivilegeError.

Alembic head: 0105 → 0106

alembic/versions/0106_grant_notification_types_permissions.py

@@ -0,0 +1,26 @@
+"""Grant DELETE permission on notification_types to app DB roles.
+
+The unified_search plugin activation calls sync_notification_types() which
+DELETEs stale rows from notification_types. The app DB user (crm_api) lacks
+DELETE permission on this table, causing plugin activation to fail with
+InsufficientPrivilegeError.
+
+Revision ID: 0106
+"""
+
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0106"
+down_revision = "0105"
+
+
+def upgrade() -> None:
+    # Grant all necessary permissions on notification_types to app roles
+    for role in ["crm_api", "crm_auth", "crm_worker"]:
+        op.execute(f"GRANT SELECT, INSERT, UPDATE, DELETE ON notification_types TO {role}")
+
+
+def downgrade() -> None:
+    for role in ["crm_api", "crm_auth", "crm_worker"]:
+        op.execute(f"REVOKE DELETE ON notification_types FROM {role}")