feat: establish v0.70 platform milestone

migrations/000040_device_database_credential.up.sql

@@ -0,0 +1,29 @@
+BEGIN;
+
+CREATE TABLE device_credential (
+    device_id          uuid PRIMARY KEY,
+    tenant_id          uuid NOT NULL,
+    credential_ref     varchar(500) NOT NULL UNIQUE,
+    key_version        bigint NOT NULL DEFAULT 1 CHECK (key_version > 0),
+    algorithm          varchar(32) NOT NULL DEFAULT 'HMAC-SHA256'
+                       CHECK (algorithm = 'HMAC-SHA256'),
+    encryption         varchar(32) NOT NULL DEFAULT 'AES-256-GCM'
+                       CHECK (encryption = 'AES-256-GCM'),
+    encrypted_secret   bytea NOT NULL,
+    nonce              bytea NOT NULL CHECK (octet_length(nonce) = 12),
+    status             varchar(24) NOT NULL DEFAULT 'active'
+                       CHECK (status IN ('active', 'revoked')),
+    created_at         timestamptz NOT NULL DEFAULT now(),
+    rotated_at         timestamptz,
+    revoked_at         timestamptz,
+    CONSTRAINT device_credential_device_tenant_fk
+        FOREIGN KEY (device_id, tenant_id) REFERENCES device(id, tenant_id)
+);
+
+CREATE INDEX device_credential_tenant_status_idx
+    ON device_credential (tenant_id, status);
+
+COMMENT ON TABLE device_credential IS
+    'Recoverable device HMAC credentials encrypted with the API credential master key; plaintext is never stored.';
+
+COMMIT;