Add cleanup indexes for ASB retention paths

[haasonsaas]

Summary

• add the missing Postgres indexes that match ASB's cleanup query shapes and audit time-range scans
• add a dedicated grants.session_id index for session revocation lookups
• bound and order ListGrantsBySession so the session-grant lookup is no longer unbounded

Testing

• go test ./internal/store/postgres ./internal/migrate -count=1
• go test ./... -count=1
• GOTOOLCHAIN=go1.26.0 go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.3 run ./...
• git diff --check

Part of #15

[cursor]

PR Summary

Medium Risk
Primarily performance-oriented, but the new hard limit on ListGrantsBySession could truncate results for unusually large sessions and affect revoke/cleanup flows if more than 10k grants exist.

Overview
Adds a new migration (0003_cleanup_indexes.sql) that introduces several Postgres indexes to match cleanup/retention query shapes (state+expiry scans) and audit time-range scans, including a dedicated grants(session_id) index.

Updates Repository.ListGrantsBySession to return grants in a stable order (created_at, id) and cap results via a hard limit (maxGrantsBySessionLookup), with a new unit test asserting the query is ordered and bounded.

^{Reviewed by Cursor Bugbot for commit 9805c67. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue. You can view the agent here.}

^{Reviewed by Cursor Bugbot for commit 9805c67. Configure here.}

[cursor]

Silent truncation may leave grants unrevoked on session cleanup

Low Severity

ListGrantsBySession now silently caps results at 10,000, but both callers (expireSession and RevokeSession) assume they receive all grants for the session. In expireSession, the session is marked expired even when not all grants were processed, and since the session is no longer active, subsequent cleanup runs won't re-process it — leaving orphaned active grants. In RevokeSession, there's no retry mechanism at all. No error or warning is returned when the limit is reached.

 

^{Reviewed by Cursor Bugbot for commit 9805c67. Configure here.}