fix(security): F20 (Astra P1) — pauschaler Boot-GRANT entfernt, DELETE-Rechte als Migration 0145 festgeschrieben

Vorher: prestart.sh fuehrte bei JEDEM Container-Start
GRANT DELETE ON ALL TABLES fuer crm_api/crm_auth/crm_worker aus — und
hob damit Migration 0100 auf, die DELETE auf 12 sensiblen Tabellen
(audit_log, api_tokens, password_reset_tokens, tenants, ...)
gezielt entzogen hatte. Der Blanket-Grant war ein BUG-030-Workaround
(User-DELETE 500), der den Schutz seit jedem Start zerstoerte.

Fix:
- Migration 0145 (0145_delete_grants_converged): deterministischer
  Sollzustand — REVOKE DELETE auf geschuetzten Tabellen von beiden
  Runtime-Rollen (audit_log, api_tokens, password_reset_tokens,
  plugin_allowlist, plugin_migrations, tenants,
  tenant_plugin_activation); GRANT DELETE auf legitime Runtime-Loeschungen
  (users, user_tenants, sessions, plugins, notification_types) NUR fuer
  crm_api; crm_worker erhaelt kein DELETE auf geschuetzten Tabellen.
- prestart.sh: Blanket-GRANT-Block entfernt, durch dokumentierenden
  Verweis auf 0145 ersetzt.
- audit.py Retention-Route: Delete laeuft ueber Migrations-Session-Factory
  (Table-Owner) statt Request-DB — Runtime-Rollen koennen Auditdaten
  schreiben aber NIEMALS loeschen (Astra-Abnahme). Gleiches Muster wie
  Plugin-Uninstall.

Abnahme (Astra): API und Worker koennen Auditdaten schreiben, aber nicht
loeschen — erfuellt (audit_log DELETE von crm_api/crm_worker entzogen,
Retention als dokumentierte Wartungsoperation ueber Owner-Session).

Verifikation: Migration-Syntax OK, ruff clean, alembic heads = genau 0145,
prestart bash -n OK, test_audit_architecture_fixes + test_user_service
30/30 (Logout-Session-Delete, User-DELETE, Audit-Pfade alle intakt).

Bekannte Grenze (ehrlich): Kuenftige Plugin-Tabellen brauchen ihre
DELETE-Rechte in der jeweiligen Migration statt im Boot-Skript —
sync_plugin_schema.py vergibt KEINE GRANTs (verifiziert), deshalb ist
das Default-Privilege-Problem in S2 (F18 Schema-Verantwortung)
adressiert.

prestart.sh

@@ -70,35 +70,17 @@ PYEOF
 python3 /tmp/set_role_passwords.py
 rm -f /tmp/set_role_passwords.py
 
-# Grant DELETE on all tables to crm_api, crm_auth, crm_worker (BUG-030 fix)
-echo "[prestart] Granting DELETE on all tables to crm_api, crm_auth, crm_worker..."
-python3 -c "
-import asyncio, os
-from sqlalchemy.ext.asyncio import create_async_engine
-from sqlalchemy import text
-
-async def grant_delete():
-    db_url = os.environ.get('MIGRATION_DATABASE_URL', os.environ.get('DATABASE_URL', ''))
-    if not db_url:
-        print('[prestart] No DATABASE_URL found, skipping GRANT DELETE')
-        return
-    engine = create_async_engine(db_url)
-    try:
-        async with engine.begin() as conn:
-            for role in ['crm_api', 'crm_auth', 'crm_worker']:
-                try:
-                    await conn.execute(text(f'GRANT DELETE ON ALL TABLES IN SCHEMA public TO {role}'))
-                    print(f'[prestart] GRANT DELETE to {role} OK')
-                except Exception as e:
-                    print(f'[prestart] WARNING: Could not GRANT DELETE to {role}: {e}')
-        print('[prestart] GRANT DELETE complete.')
-    except Exception as e:
-        print(f'[prestart] WARNING: Could not GRANT DELETE: {e}')
-    finally:
-        await engine.dispose()
-
-asyncio.run(grant_delete())
-"
+# F20 (Astra P1): the blanket "GRANT DELETE ON ALL TABLES" block that used
+# to run here was removed — it silently undid migration 0100's targeted
+# DELETE revocations on EVERY container start (audit_log, api_tokens,
+# password_reset_tokens, tenants, ...).
+# The documented target state now lives in migration 0145
+# (0145_delete_grants_converged.py): runtime DELETEs only where the app
+# legitimately deletes rows (users, user_tenants, sessions, plugins,
+# notification_types) and DELETE revoked from crm_api/crm_worker on all
+# protected tables. Audit-log retention runs via the migration session
+# factory (app/routes/audit.py), plugin uninstall via the migration
+# factory as before.
 
 # Set crm_runtime password if RUNTIME_DB_PASSWORD is set (legacy support)
 if [ -n "$RUNTIME_DB_PASSWORD" ]; then