chore: establish local platform baseline

migrations/000025_certificate_inventory.up.sql

@@ -0,0 +1,19 @@
+BEGIN;
+
+ALTER TABLE ops_resource_reference
+    DROP CONSTRAINT ops_resource_reference_resource_type_check;
+ALTER TABLE ops_resource_reference
+    ADD CONSTRAINT ops_resource_reference_resource_type_check
+    CHECK (resource_type IN ('PROVIDER_CREDENTIAL','VOICE_RESOURCE','MODEL_RESOURCE','CERTIFICATE'));
+ALTER TABLE ops_resource_reference
+    ADD COLUMN expires_at timestamptz;
+ALTER TABLE ops_resource_reference
+    ADD CONSTRAINT ops_resource_reference_certificate_expiry_check CHECK (
+        (resource_type='CERTIFICATE' AND expires_at IS NOT NULL) OR
+        (resource_type<>'CERTIFICATE' AND expires_at IS NULL)
+    );
+CREATE INDEX ops_resource_reference_certificate_expiry_idx
+    ON ops_resource_reference(tenant_id,expires_at)
+    WHERE resource_type='CERTIFICATE' AND status='ACTIVE';
+
+COMMIT;