feat(requests): patch-request lifecycle — submit / approve / reject / cancel

[haydercyber]

Summary

Piece 3b of three. Lands the UI-driven secret-update vertical: a developer proposes new values for one or more keys inside an existing provider secret, the plaintext is envelope-encrypted on the way in, the request walks the dynamic workflow + policy engine from Piece 2 (#14), and approvers vote until the workflow threshold is crossed.

The wire shape carries only key NAMES — secret values never leave the wrap layer.

Endpoints (under /api/v1)

POST   /requests                  submit a patch request
GET    /requests                  list (filter: requester_id, status)
GET    /requests/:id              get one + its approvals inline
POST   /requests/:id/approve      cast approve vote
POST   /requests/:id/reject       cast reject vote with reason
POST   /requests/:id/cancel       requester withdraws

Lifecycle invariants

Invariant	How enforced
Plaintext never lands in Postgres outside the wrap envelope	WrapService.Wrap AES-256-GCM + canary test
Plaintext never appears in audit metadata	service audits byte_length + SHA-256 hash only
Plaintext never appears in API responses	RequestBody exposes only target_keys (names)
One vote per approver per request	schema UNIQUE INDEX + service pre-check + 23505 mapping → ErrDuplicateVote → HTTP 409
Requester cannot self-approve unless workflow opts in	wf.AllowSelfApproval per-workflow toggle (default false)
TTL refresh on state transitions	approve → WrapTTLApproved (default 1h); reject/cancel → 5 min
Only the original requester can cancel	service compares actorID to req.RequesterID
Every state change emits an audit event with CorrelationID = request.ID	submit / approve / reject / cancel / refresh_ttl_failed
Workflow captured at submit time, not at approve time	workflow_id set on the request row in Submit

Schema changes (migration 0006)

• Extend access_requests with workflow_id, target_provider_type|config|secret_ref|keys|scope, job_id, reject_reason
• Make secret_mapping_id nullable (patch flow doesn't need a mapping; legacy fields stay reserved)
• Add 'patch' to type CHECK, 'cancelled' to status CHECK
• CHECK (type='patch' ⇒ workflow_id + target_provider_type + target_secret_ref NOT NULL)
• UNIQUE INDEX approvals_one_decision_per_approver on (request_id, approver_id)

Test plan

• go build / vet ./... clean
• 9 new integration tests pass (live Postgres)
• Full suite green with -p 1
• Live e2e curl: submit → self-approve 403 → approve → dup-vote 409 → reject with reason → cancel by stranger 403 → cancel by requester
• Bytea position search across secret_wraps for canary plaintext returns 0 matches (envelope encryption confirmed)
• CI green

Followups (out of scope)

• Piece 3c: agent wrap retrieval endpoint (GET /agents/:id/wraps/:wrap_id under AgentAuth)
• Piece 4: agent ProviderExecutor that consumes wraps + writes to providers
• Pieces 5-6: UI scaffold + dev/approver pages