feat(server): central audited chokepoint for customer-data drops + CI guard (truehomie hardening)

[mastermanas805]

What & why

Addresses the OPEN root-cause class of the truehomie-db DROP incident (2026-06-03): an active Pro customer's Postgres DB + role were dropped on the shared postgres-customers cluster by an unidentified path with NO audit_log row. The provisioner was a dumb executor — DeprovisionResource dropped whatever (token, provider_resource_id, resource_type) it received and kept no record of its own.

Full enumeration + design + ranked root-cause hypotheses: docs/ci/DATA-INTEGRITY-DROP-PATH-AUDIT.md (docs repo).

Changes

1. guardedDrop chokepoint (internal/server/drop_chokepoint.go) — the single sanctioned wrapper for a customer-data destruction. All 8 backend Deprovision dispatches in DeprovisionResource (postgres/redis/mongo/queue × shared/dedicated) now route through it. It emits, before the drop:
   • a structured event=provisioner.drop audit log line: token, provider_resource_id, resource_type, backend, request_id, caller (gRPC peer addr — the attribution that was missing in the incident). Always-on, app-layer equivalent of the cluster log_statement='ddl' trap.
   • instant_provisioner_drop_total{resource_type,backend,outcome} (eager) — an abnormal drop rate is now alertable (the incident was a burst of un-attributed drops).
2. CI guard (internal/server/drop_guard_test.go) — AST-iterating (rule 18). Walks the provisioner source and fails the build if any DROP DATABASE/ROLE/USER SQL literal, ACL DELUSER, mongo dropDatabase, or Database(...).Drop(...) call appears outside a sanctioned deprovision function reached through guardedDrop. A new un-audited drop path cannot merge. Proven non-vacuous (TestDropGuard_FlagsUnsanctionedSite) and comment-safe (TestDropGuard_IgnoresComments); does not flag Collection.Drop (sentinel cleanup, not customer data).

Surgical / safe

Behaviour of what gets purged in the TTL reaper / team-deletion / user-DELETE flows is unchanged — the chokepoint only ADDs the audit + metric around the existing dispatch. The breaker wrapping is preserved. No proto change, no platform-DB access, no flag needed.

The larger fix for invariant (3) — a DeprovisionRequest.deletion_intent proto field + provisioner terminality enforcement (needs platform-DB read, fail-closed) — is designed + filed, not rushed, to avoid breaking the legitimate purges that drop active rows by design.

Verification

• make gate: green (build + vet + go test ./... -short -count=1 -p 1, all packages).
• New tests (9): chokepoint ok/error/breaker-open outcomes + metric assertions, caller attribution, and the CI guard (real-tree scan + synthetic positive + comment negative).
• Rule 25: alert + dashboard tile + catalog row for instant_provisioner_drop_total ship in the matching infra PR.

🤖 Generated with Claude Code