refactor(db): move relay invite store ownership

[TheSentinel454]

Summary

Continue tracker #2 by making relay_invite.rs own the durable v2 relay-invite persistence boundary. ClaimOutcome, MintedInvite, validation, SQL, transaction/locking behavior, and focused tests already lived there; this child moves the three remaining Db APIs and datastore spans out of lib.rs.

This also advances #17 and #19: all focused invite tests stay beside the implementation, and a source guard proves each public operation and record type has one owner with one span per logical operation.

Stack

• Tracker: TheSentinel454/buzz#2
• Test ownership acceptance: #17
• Span ownership acceptance: #19
• Exact base: codex/issue-2-relay-members-store at 75a5146 (#6804)
• Exact head: codex/issue-2-relay-invite-store at 849b817

Domain moved

• Db::mint_relay_invite
• Db::reap_expired_relay_invites
• Db::claim_relay_invite
• Their existing datastore spans, unchanged names and fixed labels
• A source guard covering facade/SQL dual ownership, unique spans, and single ownership of ClaimOutcome and MintedInvite

crates/buzz-db/src/lib.rs falls from 4,259 to 4,211 lines.

Non-goals

• Canonical relay-membership or authentication-allowlist behavior
• Invite validation, token hashing, retention, fence, SQL, locking, transaction, retry, or response semantics
• Generic store traits, raw pool access, executor migration, or crate reorganization

Risk

Small review surface and low semantic risk. The three facades and spans moved intact and still call the same module-owned functions with the same pool, arguments, and return types. The full claim transaction—including FOR UPDATE, membership insertion, policy evidence, and use-count update—is unchanged.

Blox verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 5a497a98cefd2dd531f8bde48b5b5ee2c4cb4362.

• cargo fmt --all --check
• git diff --check 14924657e84d5d516fb0022e0681cbe18391ea77..HEAD
• cargo clippy -p buzz-db --all-targets -- -D warnings
• cargo clippy -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib: 108 passed, 200 ignored
• cargo test -p buzz-db --test store_ownership: 14 passed
• cargo test -p buzz-db --test observability_source: 1 passed
• Native PostgreSQL 17.11, migrations 1–32 already applied: all 8 relay-invite PostgreSQL tests passed
• cargo test -p buzz-relay --lib: 909 passed, 48 ignored
• Signed commit hooks passed

Independent exact-head Blox review: no findings. A separate clean workstation verified exact base/head geometry, unchanged signatures and transaction bytes, fixed-label single span ownership, formatting, diff hygiene, both clippy targets, 108 DB unit tests, 14 ownership guards, the observability guard, all 9 relay-invite tests (including validation), and 909 relay tests. Review artifacts were preserved before teardown.

Remaining tracker work

Next: moderation/product feedback, then git registry and archived identities, usage/admin/maintenance, deletion ownership, and the final runtime-boundary audit.

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

Outcome

No actionable findings.

Reviewed exact direct-parent range 245c08f24df4e77c0e8486f9aa7abcc70d784e7b..dd7e3c290792b1a68cc73225af87a494ae35d271 on fresh Blox workstation buzz-tornquist-pr-6805-final-review (ID 2057730). The three relay-invite wrappers and spans move beside the invite SQL and records without changing validation bounds, token hashing, claim transaction/locking, typed outcomes, or public signatures.

Verification

• Formatting, range/worktree diff checks, touched-crate clippy, and clean-tree checks passed.
• Store-ownership guards: 14 passed; observability source guard: 1 passed.
• Non-PostgreSQL relay-invite tests: 1 passed, 8 ignored.
• Relay consumer compile passed.
• Native PostgreSQL 17: all 8 relay-invite tests passed, including final-slot concurrency, tenant scope, policy rollback, retention fencing, and use limits.
• Exact head and merge-base were rechecked.

No code edits or external mutations were made. Buzz relay credentials/ownership reporting were unavailable under the documented fallback. The workstation was deleted after artifact transfer.

Artifacts

• Diff SHA-256: a1c4894779f7428dd40f785256f614f6f8c98d4d91c9e4b013aa312b70012581
• Verification log SHA-256: 80d4512d8587b07dd8b832e16412d8d588060067fe10c9f97ecc12ac7547ee15
• Artifact archive SHA-256: 8bd5402553edd0d8d7adac8d6902927c592dbba047447f81cdaae9e2029f1098

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: 75a5146da1e7886e7ad7e5a957e56288d42e8d61
• Exact head: 849b81729ebbf0a92e755fea220187db4ed816ae
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict buzz-db Clippy, current ownership/observability guards, relay-invite tests (1 unit plus 8 PostgreSQL), and relay compilation.