fix(migrations): F40 (Astra P1) — Plugin-Migrationen tracken SHA-256-Content-Hash, Drift wird sichtbar

Vorher: Der Migration-Runner trackte Migrationen nur per DATEINAMEN —
eine nachtraeglich geaenderte, bereits angewandte Migration blieb
unbemerkt (genau die #389-Bugklasse: kaputte Migration wurde gefixt,
Runner skippte still, weil der Dateiname schon getrackt war).

Fix:
- Migration 0148: content_hash-Spalte (SHA-256, 64 Zeichen) in
  plugin_migrations + Index
- PluginMigration-Modell: content_hash-Feld
- run_migration: speichert den Hash des angewandten SQL-Inhalts
- run_all_migrations: vergleicht bei bereits angewandten Migrationen
  den Hash und warnt LAUT bei Abweichung (F40 DRIFT-Warnung mit Plugin,
  Datei, recorded/current-Hash) — Skip bleibt idempotent (kein Deploy-
  Bruch bei legitimen Reparaturen), aber Drift ist ab JETZT sichtbar

Abnahme (Astra): Eine veraenderte angewandte Migration wird erkannt —
erfuellt (Drift-Warnung im Runner-Log; #389 haette so beim naechsten
Start aufgefallen).

Verifikation: Syntax OK, ruff clean, alembic heads = 0148.

app/plugins/migration_runner.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import logging
 import os
 from pathlib import Path
 from typing import Any
@@ -11,6 +12,8 @@ from sqlalchemy.ext.asyncio import AsyncEngine, AsyncSession
 
 from app.models.plugin import PluginMigration
 
+logger = logging.getLogger(__name__)
+
 
 class MigrationValidationError(Exception):
     """Raised when a plugin migration creates a table without tenant_id column."""
@@ -124,12 +127,20 @@ class MigrationRunner:
             plugin_name=plugin_name,
             migration_file=migration_filename,
             status="applied",
+            content_hash=self._hash_sql(sql_content),  # F40 (Astra): record applied content
         )
         db.add(migration_record)
         await db.flush()
 
         return migration_record
 
+    @staticmethod
+    def _hash_sql(sql_content: str) -> str:
+        """F40: SHA-256 of migration SQL content for drift detection."""
+        import hashlib
+
+        return hashlib.sha256(sql_content.encode("utf-8")).hexdigest()
+
     async def run_all_migrations(
         self,
         db: AsyncSession,
@@ -150,11 +161,34 @@ class MigrationRunner:
                 PluginMigration.status == "applied",
             )
         )
-        applied_files = {row.migration_file for row in result.scalars().all()}
+        applied_rows = {row.migration_file: row for row in result.scalars().all()}
+        applied_files = set(applied_rows.keys())
 
         records: list[PluginMigration] = []
         for filename in migration_files:
             if filename in applied_files:
+                # F40 (Astra): hash check — a modified already-applied
+                # migration must be VISIBLE, not silently skipped. This is
+                # exactly the #389 bug class: a broken migration was fixed
+                # on disk, but the runner skipped it by filename forever.
+                record = applied_rows[filename]
+                try:
+                    path = self._resolve_migration_path(filename, plugin_name)
+                    current_hash = self._hash_sql(path.read_text(encoding="utf-8"))
+                except FileNotFoundError:
+                    continue  # file gone (plugin removed it) — nothing to compare
+                if record.content_hash is not None and record.content_hash != current_hash:
+                    logger.warning(
+                        "F40 DRIFT: plugin '%s' migration '%s' was MODIFIED after being "
+                        "applied (recorded=%s current=%s). The runner keeps the skip "
+                        "(idempotent), but the schema may no longer match the file. "
+                        "If the change is intentional, verify the schema and consider "
+                        "a follow-up migration instead of editing an applied one.",
+                        plugin_name,
+                        filename,
+                        (record.content_hash or "")[:12],
+                        current_hash[:12],
+                    )
                 continue  # Already applied — idempotent skip
             record = await self.run_migration(db, plugin_name, filename, tenant_id)
             records.append(record)