feat: add platform staff management

scripts/production-readiness-check.js

@@ -394,10 +394,47 @@ async function validateDatabase() {
       pass('db.provider_public_config', 'Active provider public configs do not contain secret-like keys');
     }
 
+    const activePlatformAdminRows = await pool.query(`
+      select id, username, phone, auth_user_id
+      from public.platform_users
+      where primary_role = 'platform_admin'
+        and status = 'active'
+      order by created_at asc
+      limit 20
+    `);
+    if (activePlatformAdminRows.rowCount === 0) {
+      block('db.platform_admin_active', 'At least one active platform admin user is required');
+    } else {
+      pass('db.platform_admin_active', 'Active platform admin users found', { count: activePlatformAdminRows.rowCount });
+    }
+
+    const activePlatformAdminsWithoutAuth = await pool.query(`
+      select id, username, phone
+      from public.platform_users
+      where primary_role = 'platform_admin'
+        and status = 'active'
+        and auth_user_id is null
+      order by created_at asc
+      limit 20
+    `);
+    if (activePlatformAdminsWithoutAuth.rowCount > 0) {
+      block('db.platform_admin_auth_binding', 'Active platform admin users must be bound to Supabase Auth users', {
+        count: activePlatformAdminsWithoutAuth.rowCount,
+        samples: activePlatformAdminsWithoutAuth.rows.map(row => ({
+          id: row.id,
+          username: row.username,
+          phone: row.phone ? `${String(row.phone).slice(0, 3)}****${String(row.phone).slice(-4)}` : null,
+        })),
+      });
+    } else {
+      pass('db.platform_admin_auth_binding', 'Active platform admin users are bound to Supabase Auth users');
+    }
+
     const platformAdminsWithoutPermissions = await pool.query(`
       select id, username, phone
       from public.platform_users
       where primary_role = 'platform_admin'
+        and status = 'active'
         and (platform_permissions is null or platform_permissions = '{}'::jsonb)
       order by created_at asc
       limit 20
@@ -415,6 +452,32 @@ async function validateDatabase() {
       pass('db.platform_admin_permissions', 'Platform admin users have explicit permission maps');
     }
 
+    const disabledPlatformAdminsWithActiveSessions = await pool.query(`
+      select u.id, u.username, u.phone, count(s.id)::int as active_session_count
+      from public.platform_users u
+      join app_private.auth_sessions s on s.user_id = u.id
+      where u.primary_role = 'platform_admin'
+        and u.status = 'disabled'
+        and s.revoked_at is null
+        and s.expires_at > now()
+      group by u.id, u.username, u.phone
+      order by active_session_count desc
+      limit 20
+    `);
+    if (disabledPlatformAdminsWithActiveSessions.rowCount > 0) {
+      block('db.platform_admin_disabled_sessions', 'Disabled platform admin users must not have active legacy sessions', {
+        count: disabledPlatformAdminsWithActiveSessions.rowCount,
+        samples: disabledPlatformAdminsWithActiveSessions.rows.map(row => ({
+          id: row.id,
+          username: row.username,
+          phone: row.phone ? `${String(row.phone).slice(0, 3)}****${String(row.phone).slice(-4)}` : null,
+          activeSessionCount: row.active_session_count,
+        })),
+      });
+    } else {
+      pass('db.platform_admin_disabled_sessions', 'Disabled platform admin users have no active legacy sessions');
+    }
+
     const missingAuthSecretRows = await pool.query(`
       select p.tenant_id, p.provider
       from public.tenant_auth_providers p