Add durable schema migrations and continuity gates

[xrpbanks]

Summary

This stacked DS-2 draft builds on #29 and adds the next durable-data and release-safety layer without selecting a provider, creating a live database, deploying, merging, or publishing.

Durable data

• add a formal forward-only schema migration baseline and revision history
• preserve the supported legacy food-log schema during upgrade
• detect schema drift against the current SQLModel metadata
• allow SQLite only in local/test and fail closed for staging/production
• auto-upgrade known migrations only in local/test; staging/production must be explicitly upgraded with an approval reference
• add a database/schema-aware /ready endpoint
• add empty-database migration smoke checks to CI and the release script
• formalize the no-additional-subscription, free-core and provider-neutral exit boundaries
• document why BigchainDB is not selected for the private user-data foundation
• preserve future voluntary XRPL transaction-hash linking as disabled-by-default

Official product and separate ecosystem

• keep the official Gallery Token website, webapps, Identity Bridge service, databases, brand and releases under Pieter Hendrikse and the designated Gallery Token development team
• define the ecosystem as a separate interoperability layer, not shared control of official products
• permit technology to cross into ecosystem reuse only under an explicit component licence or written permission
• define the official Identity Bridge as a future operator-controlled gateway, never direct access to identity/session stores
• allow future premium managed developer services without selling broader personal-data access or official status
• define emergency continuity as preservation/recovery, not automatic active-control or brand transfer

Identity Bridge code provenance

• inventory every file permitted in the deterministic plugin archive
• document WordPress, Xaman API and existing XUMM Login integration boundaries
• record that no Composer/npm/vendor/Xaman SDK tree is bundled, while avoiding an unsupported claim that no code was ever adapted
• identify the current reads of xummlogin_api_key, xummlogin_api_secret and xummlogin_create_user as a source/version/licence review blocker
• require contributor, source and AI-assistance declarations plus reproducible similarity review against the exact installed XUMM Login package
• include provenance status in locally built inspection manifests
• make the tag-release workflow refuse public distribution until provenance status is explicitly cleared
• make adding an unclassified plugin-release file fail automatically

The repository grants no general reuse licence. The separately packaged Identity Bridge declares GPL-2.0-or-later, but that component licence does not grant access to the official service, production configuration, user data, branding or official status.

No ecosystem developer access is enabled here. A future client interface remains disabled by default and requires reviewed registration, explicit per-purpose user consent, least-privilege scopes, pairwise pseudonymous subjects, short-lived audience-restricted tokens, redirect allowlisting and revocation.

Verification

• 270 backend tests passed
• 10 Identity Bridge contract/provenance/release-builder tests passed
• Identity Bridge contract synchronization passed
• backend compilation passed
• empty-database migration upgrade and head check passed
• local deterministic plugin inspection build passed
• public plugin release was confirmed blocked by the provenance gate
• frontend lint passed with no warnings or errors
• frontend production build passed
• Git whitespace validation passed
• legal/licensing boundary checks passed
• tracked artifact boundary passed

Known non-blocking warning: the existing Starlette TestClient deprecation warning.

Release boundary

Still blocked pending PostgreSQL staging validation, zero-additional-cost provider/capacity/exit proof, restart and redeploy persistence, export/import, complete account erasure, encrypted backup and restore drill, retention/privacy approval, confidential operator recovery testing, and Identity Bridge source clearance.

No merge, deployment, provider account, live-user onboarding, external developer access, XRPL enablement, financial action, public publication, plugin release, or brand change is included.