fix(#243,#247,#248): close the GDPR group-messaging bug cluster

[TortoiseWolfe]

Summary

Closes the GDPR / group-messaging subset of the Gap-Audit cluster: #243, #247, #248 — the trio about group conversations. Each was verified against the real code + live DB before fixing, and a 3-agent adversarial design review caught five defects in the initial designs that are all fixed here.

Follow-up to #276 (the security-critical batch). Two cluster bugs remain after this — messaging reliability #244/#245/#246 — designed and deferred.

The three fixes

#247 — Account deletion blocked for group creators (right-to-erasure)

conversations.created_by + group_keys.created_by were ON DELETE NO ACTION, so a user who created a group or distributed group keys couldn't be erased.

• Both FKs → ON DELETE SET NULL (deleting the creator preserves the group + every other member's keys; CASCADE would destroy the group for everyone). created_by made nullable, CHK023 relaxed.
• Adversarial-review catch: SET NULL then erasing a sole owner orphaned the group with no owner — every isOwner-gated op (rename/remove/delete/transfer) would fail forever. Added a BEFORE DELETE trigger on conversation_members that auto-transfers ownership to the earliest-joined survivor.

#248 — Data export omits group conversations (data-portability)

exportUserData enumerated by participant_1/2 columns — NULL for groups → groups silently absent.

• Enumerate groups via conversation_members, decrypt each message through the group-key path at its own key_version (new order-agnostic group-message-decrypt helper), include group_name + member roster, count in stats.
• Review catches: call restoreKeysFromCache() before the group loop (the export page has no EncryptionKeyGate → cold keys → placeholders otherwise); surface system-message plaintext markers instead of decrypting them to a placeholder.

#243 — Rotating a group creator's personal keys bricked group history

The reader unwrapped with the creator's current public key; after rotation, ECDH mismatched → history bricked for every member.

• Capture the creator's wrap-time public JWK on each group_keys row (creator_public_key) and unwrap against it; legacy rows fall back to a time-window resolver over the retained key history.
• Backfill (run via Management API — the immutable-keys UPDATE policy blocks client writes) repaired all 331 existing rows, un-bricking past history.
• Review catch: the fallback is null-safe on created_by (which Account deletion fails for users who created group chats (GDPR erasure blocked) #247 can SET NULL).

Verification

• Rotating a group creator's keys permanently breaks the group's message history #243 — real crypto (no mocks): group-key-roundtrip.node.test wraps a key, rotates the creator, proves unwrap with the current key fails and with the stored key succeeds, and a pre-rotation message still decrypts.
• Account deletion fails for users who created group chats (GDPR erasure blocked) #247 — live DB: RLS DB-contract tests — erasure succeeds, group survives with created_by nulled, ownership auto-transfers to the survivor.
• Data export silently omits group-chat messages (GDPR portability incomplete) #248 — unit: group enumeration, roster, decrypt threading, cold-key restore, stats.
• Full 68-test RLS suite + 179 messaging unit tests green; type-check + lint clean.

Schema applied live via the Management API (idempotent, in the monolithic migration) — no separate merge-time DB step needed; the backfill already ran. No edge-function changes.

🤖 Generated with Claude Code