Cross-user reference fix, request logging, credential cleanup and migration drift guard

[rghvgrv]

Five issues from the architecture review, one commit each.

Closes #119
Closes #121
Closes #122
Closes #123
Closes #124

#119 — cross-user category/payment-source references (the one that matters)

The foreign keys on user_subscriptions require only that the referenced row exists, not that it belongs to the caller. Create and update took CategoryId and PaymentSourceId straight from the body, and BuildDtoQuery joined both tables unfiltered — so an authenticated user could attach another user's private category or payment source to their own subscription and read the resolved name and label back out.

Fixed on both sides, because either alone leaves a hole:

• ValidateCatalogReferenceAsync becomes ValidateReferencesAsync, checking all three references and collecting every violation into one ValidationProblem. A category must be a system default or the caller's; a payment source must be the caller's. Same message whether the row is missing or foreign, so a 400 never confirms an id exists.
• BuildDtoQuery filters the category and payment-source sides to what the caller may see before joining, so a subscription pointing at a stranger's row resolves to a null name/label. This keeps the read path safe on its own, including for rows written before the check existed.

New CrossUserReferenceTests covers create and update with foreign ids, the system-default category that a blunt "must be mine" check would wrongly reject, own-rows-still-work, and a read-path test that writes the cross-tenant reference directly to the database to prove the join scoping stands alone.

#122 — GlobalExceptionHandler

Client disconnects (OperationCanceledException) were logged at Error and answered with a write to a dead connection — routine mobile traffic counted as server faults. Added the same cancellation filter every background service already has. Also added a traceId to the ProblemDetails so a quoted error maps to a log line, and a HasStarted guard so an exception mid-stream no longer throws from inside the exception handler.

#121 — request logging

Serilog was configured but UseSerilogRequestLogging was never called, and Microsoft.AspNetCore sits at Warning — so 200s, 401s, 404s and 429s produced no output at all. Added the request log (enriched with user id only; no emails, tokens or reset codes), a warning on rate-limit rejection, and a warning on the refresh-token reuse branch — that path signs a user out of every device and previously left no trace.

#123 — credential cleanup

Nothing ever deleted from refresh_tokens or password_reset_codes. With 15-minute access tokens and rotation on every use, one active client writes a refresh-token row every ~15 minutes against a 0.5 GB database. New daily ExpiredCredentialCleanupBackgroundService, shaped after FxRateRefreshBackgroundService, using ExecuteDelete.

Retention windows are load-bearing: refresh tokens survive 7 days past expiry because deleting one at expiry makes it indistinguishable from a token that never existed, and RefreshAsync treats those cases differently — the unknown-token path is what drives reuse detection.

#124 — migration drift

SchemaMigrationTests asserts columns against a hardcoded list, so a configuration change with no migration passes: it builds the old schema and asserts the old columns. HasPendingModelChanges compares the model against the snapshot with no database involved. Verified in both directions — passes on this tree, fails with the intended message when a property is added without a migration.

Testing

Suite	Result
SubVora.Application.Tests	27 passed
SubVora.Infrastructure.Tests (Docker-free subset, incl. new drift test)	25 passed
GlobalExceptionHandlerTests	4 passed
CrossUserReferenceTests, ExpiredCredentialCleanupTests	compile only — not executed

Docker was not running locally, so the Testcontainers-backed suites could not be exercised. The #119 and #123 tests are unverified at runtime and need a CI run (or a local run with Docker up) before this merges. Everything that does not need a container passes.

Not included

#120 (production migrations never run automatically) is left out deliberately — fixing it means overriding a decision recorded in CLAUDE.md and docs/DEPLOYMENT.md ("In the Production environment the API does not migrate on startup — that is deliberate"). That is a call to make, not to assume. #124 here is a prerequisite either way.

[rghvgrv]

Update: the Testcontainers suites have now run. Docker came up locally, so the caveat in the description is resolved — nothing here is unverified any more.

Suite	Result
SubVora.Api.Tests (full, incl. CrossUserReferenceTests)	119 passed, 0 failed
SubVora.Infrastructure.Tests (full, incl. ExpiredCredentialCleanupTests)	98 passed, 0 failed
SubVora.Application.Tests	27 passed

The 6 CrossUserReferenceTests cases pass against a real Postgres — including the read-path one that writes the cross-tenant reference directly to the database and asserts the joined PaymentSourceLabel/CategoryName come back null.

No changes to the branch; this is the same commits, now exercised.