feat: strengthen risk controls and review workflows

api/prisma/migrations/20260726090000_allow_reuse_deleted_user_logins/migration.sql

@@ -0,0 +1,15 @@
+DROP INDEX IF EXISTS "User_username_key";
+DROP INDEX IF EXISTS "User_email_key";
+DROP INDEX IF EXISTS "User_phone_key";
+
+CREATE UNIQUE INDEX "User_active_username_key"
+ON "User" ("username")
+WHERE "deletedAt" IS NULL;
+
+CREATE UNIQUE INDEX "User_active_email_key"
+ON "User" ("email")
+WHERE "deletedAt" IS NULL AND "email" IS NOT NULL;
+
+CREATE UNIQUE INDEX "User_active_phone_key"
+ON "User" ("phone")
+WHERE "deletedAt" IS NULL AND "phone" IS NOT NULL;

api/prisma/migrations/20260726113000_add_application_disabling_lifecycle/migration.sql

@@ -0,0 +1,7 @@
+ALTER TABLE "SmsApplication"
+ADD COLUMN "disablingAt" TIMESTAMP(3),
+ADD COLUMN "autoDisableAt" TIMESTAMP(3),
+ADD COLUMN "disableReason" TEXT;
+
+CREATE INDEX "SmsApplication_status_autoDisableAt_idx"
+ON "SmsApplication"("status", "autoDisableAt");

api/prisma/migrations/20260726143000_application_risk_rules/migration.sql

@@ -0,0 +1,39 @@
+-- Risk thresholds now inherit from global rules and may be overridden per application.
+-- Existing maxPhonesPerTask values are intentionally discarded because this environment
+-- contains test-only application data and the product owner explicitly declined migration.
+ALTER TABLE "RiskRule" ADD COLUMN "applicationId" TEXT;
+
+-- Retain historical rules and hit records for audit, but remove them from the
+-- effective rule set and configuration page.
+UPDATE "RiskRule"
+SET "status" = 'deleted'
+WHERE "code" IN (
+  'DUPLICATE_PHONE_RATIO',
+  'ILLEGAL_PHONE_RATIO',
+  'BLACKLIST_HIT_RATIO',
+  'TEMPLATE_VARIABLE_ANOMALY'
+);
+
+UPDATE "RiskRule"
+SET "status" = 'deleted'
+WHERE "tenantId" IS NOT NULL AND "applicationId" IS NULL;
+
+DROP INDEX IF EXISTS "RiskRule_tenantId_code_key";
+DROP INDEX IF EXISTS "RiskRule_tenantId_status_priority_idx";
+
+CREATE UNIQUE INDEX "RiskRule_applicationId_code_key"
+ON "RiskRule"("applicationId", "code");
+
+CREATE UNIQUE INDEX "RiskRule_global_code_key"
+ON "RiskRule"("code")
+WHERE "applicationId" IS NULL AND "status" <> 'deleted';
+
+CREATE INDEX "RiskRule_tenantId_applicationId_status_priority_idx"
+ON "RiskRule"("tenantId", "applicationId", "status", "priority");
+
+ALTER TABLE "RiskRule"
+ADD CONSTRAINT "RiskRule_applicationId_fkey"
+FOREIGN KEY ("applicationId") REFERENCES "SmsApplication"("id")
+ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "SmsApplication" DROP COLUMN "maxPhonesPerTask";