feat: Fusion ACC-3.2 — pont SSO draco_session (/auth/draco), liens sub → compte (migration 51) (#21)

app/migrations.py

@@ -2059,3 +2059,20 @@ def _migration_external_refs(conn: sqlite3.Connection) -> None:
         "CREATE INDEX IF NOT EXISTS idx_external_refs_owner "
         "ON external_refs(owner_type, owner_id)"
     )
+
+
+@register(51, "fusion: liens d'identité draco_links (ACC-3.2)")
+def _migration_draco_links(conn: sqlite3.Connection) -> None:
+    """Migration 51 — correspondance sub (cookie SSO draco_session,
+    émis par ObsiGate) → compte Flowdeck local. Association 1:1 ;
+    `unlinked_at` sert de pierre tombale après dissociation."""
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS draco_links (
+            sub         TEXT PRIMARY KEY,
+            user_id     INTEGER NOT NULL UNIQUE REFERENCES users(id),
+            created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+            unlinked_at TEXT
+        )
+        """
+    )