feat(mcp): подготовить сервер и доступ к приёмке

backend/drizzle/0029_mcp_routing_sources.sql

@@ -0,0 +1,23 @@
+BEGIN;
+ALTER TABLE servers ADD COLUMN IF NOT EXISTS routing_endpoint_epoch uuid NOT NULL DEFAULT gen_random_uuid();
+CREATE OR REPLACE FUNCTION mm_routing_endpoint_epoch() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+ IF ROW(NEW.host,NEW.port,NEW.username,NEW.password,NEW.use_ssl,NEW.verify_ssl,NEW.enabled)
+    IS DISTINCT FROM ROW(OLD.host,OLD.port,OLD.username,OLD.password,OLD.use_ssl,OLD.verify_ssl,OLD.enabled) THEN
+  NEW.routing_endpoint_epoch := gen_random_uuid();
+ ELSE
+  NEW.routing_endpoint_epoch := OLD.routing_endpoint_epoch;
+ END IF;
+ RETURN NEW;
+END $$;
+DROP TRIGGER IF EXISTS mm_routing_endpoint_epoch ON servers;
+CREATE TRIGGER mm_routing_endpoint_epoch BEFORE UPDATE ON servers FOR EACH ROW EXECUTE FUNCTION mm_routing_endpoint_epoch();
+ALTER TABLE mcp_routing_observations ADD COLUMN IF NOT EXISTS source_proof text;
+DO $$ BEGIN
+ IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='mcp_routing_observation_source_proof' AND conrelid='mcp_routing_observations'::regclass) THEN
+  ALTER TABLE mcp_routing_observations ADD CONSTRAINT mcp_routing_observation_source_proof CHECK(source_proof IS NULL OR source_proof ~ '^[a-f0-9]{64}$');
+ END IF;
+END $$;
+-- Existing measurements stay readable but unsigned. Never attest old samples
+-- using today's endpoint: that would invent capture-time provenance.
+COMMIT;