docs(#1528): document the MySQL DB identity model + edgeuser retirement (D10)

[divyasinghds]

What

Document the in-cluster MySQL database identity model in docs/SECURITY.md — the S0/S1 groundwork for backend#1528 (RFC-0003 D10 close-out: retire the root-equivalent edgeuser, mint tb_meta + tb_ingest). The doc described the training-pod credential model (G1) but never the DB identity model, and mentioned edgeuser only obliquely.

Changes (docs only)

• §4.1.1 MySQL database identity model — the two databases (metadata, training_test_datasets), the least-privilege identities (per-experiment users, tb_credmgr, tb_meta, tb_ingest) and edgeuser's legacy root-equivalence, as a per-identity scope / consumer / status table, plus the staged S1 → S2 → S3 retirement.
• §8.10 residual risk — edgeuser root-equivalence as a tracked gap with the staged, per-fleet, reversible-until-S3 rollout (mirrors the §8.2 egress-lockdown style).
• §10 — code-path rows for the minting (client-runtime:sql_utils.ensure_*_account) and the serviceDbAccounts gate.
• §11 — document-history entry.

Accuracy / current state

Reflects the fleet reality today, not the end state:

• edgeuser is still root-equivalent and still the default authentication identity for jobs-manager, requests-proxy, and ingestion pods.
• S1 is merged and minting-capable but serviceDbAccounts defaults off, so tb_meta/tb_ingest aren't minted anywhere yet and nothing consumes them until S2.
• tb_credmgr + per-experiment users are the already-shipped perExperimentDbCreds mechanism (backend#1181).

Review ask

This is customer-facing security wording — please sanity-check the identity/scope/consumer table in §4.1.1 and the §8.10 rollout against your intent for the D10 close-out.

Refs: backend#1528 (D10 close-out); client-runtime#290 / client#643 (S1).

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changes to customer-facing security wording; no runtime or credential behavior changes.

Overview
docs/SECURITY.md now documents the in-cluster MySQL least-privilege identity model and the planned retirement of root-equivalent edgeuser, as part of RFC-0003 D10 / backend#1528.

Under §4.1.1, it adds a table for metadata vs training_test_datasets, identities (per-experiment users, tb_credmgr, tb_meta, tb_ingest, legacy edgeuser), who uses each, and current status—including that serviceDbAccounts (default off) mints tb_meta/tb_ingest at jobs-manager startup without consumers yet. It also describes the S1 → S2 → S3 rollout (mint → switch consumers → drop edgeuser).

§8.10 tracks edgeuser root-equivalence as an in-progress G1 residual risk with the same staged, fleet-by-fleet rollout. §10 links minting to client-runtime:sql_utils.ensure_*_account and the serviceDbAccounts gate in chart templates. §11 adds a 2026-08 history entry.

^{Reviewed by Cursor Bugbot for commit 5254ac1. Bugbot is set up for automated code reviews on this repo. Configure here.}