[kipavy]

Teams can now store one policy document on the server (Business). It uses the same format as the machine policy.json (locks and $range limits, no defaults), and members receive it in GET /v1/teams. No client uses it yet; the client PR follows. Part of VoltiusApp/voltius#757.

What changes:

• Migration 067 adds teams.policy (jsonb), policy_revision, policy_updated_at and policy_updated_by. It copies every existing lock policy into the document as security.lockTimeoutMinutes: {"$range": {"max": N}} plus security.lockAction: "vault" when vault lock is forced. The migration can be run twice safely, and the same copy also runs at every boot.
• New routes: GET, PUT and DELETE /v1/teams/:id/policy.
  • Permission is the same as lock policy (manage vault or administrator).
  • PUT replaces the whole document and needs the current revision. A stale revision gets 409 POLICY_REVISION_MISMATCH.
  • The server checks structure only: version 1, key format, at most 500 keys, at most 64 KiB, $range shape, no defaults. It refuses machine-only keys (server.*, enrollment.token, plugins.install) with 400 and names the key.
  • Below Business, PUT is allowed only when it removes keys, and DELETE is always allowed.
  • Writes are audited as team.policy_set (with the added, changed and removed keys) and team.policy_removed, and every member gets team_members:<team>.
• The lock-policy endpoints keep their contract. They now edit those two keys inside the document and still write the lock_* columns. GET /v1/teams builds lock_policy from the document for shipped clients, and adds policy, policy_revision and joined_at.
• The migrator now ignores applied versions it doesn't know (set_ignore_missing). An image from before a newer migration can therefore still boot after a rollback.

Tests: full suite in Docker, 836 passed.

Deploy note: production runs sha-ad25887 (migration 066). This image applies 067 at boot. It only adds columns and copies existing lock policies, so it is short on a small table.