refactor(security): move all database access into pkg/security/lookup

pkg/security no longer contains SQL. Every provider calls a store interface
from lookup, implemented by a procedure backend (Postgres stored procedures,
the default there) and a direct backend (dialect-driven SQL for postgres,
sqlite, mysql and mssql with configurable table and column names).

- add sectypes, lookup, lookup/{dialect,procedure,direct,backends,ddl,conformance}
- split totp and providers sub packages out of the core package
- replace SQLNames/TableNames/QueryMode with lookup.Config (see breaking_changes.md)
- direct backend now covers column/row security and API-key login
- move txsettings SQL to lookup.ApplyTxSettings; remove password.go
- move schema scripts under lookup/, add reference DDL per dialect
- add a shared conformance suite; run it on sqlite, and on Postgres in a
  podman/docker container (RESOLVESPEC_TEST_CONTAINERS=1)
- fix procedure schema bugs found on real Postgres: duplicate p_data
  parameter, JSON null arrays, expires_at timezone casts, passkey list
  GROUP BY, missing resolvespec_passkey_login; accept zone-less timestamps

pkg/security/keystore.go

@@ -2,64 +2,11 @@ package security
 
 import (
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"time"
+	"github.com/bitechdev/ResolveSpec/pkg/security/sectypes"
 )
 
-// hashSHA256Hex returns the lowercase hex SHA-256 digest of the given string.
-// Used by all keystore implementations to hash raw keys before storage or lookup.
-func hashSHA256Hex(raw string) string {
-	sum := sha256.Sum256([]byte(raw))
-	return hex.EncodeToString(sum[:])
-}
-
-// KeyType identifies the category of an auth key.
-type KeyType string
-
-const (
-	// KeyTypeJWTSecret is a per-user JWT signing secret for token generation.
-	KeyTypeJWTSecret KeyType = "jwt_secret"
-	// KeyTypeHeaderAPI is a static API key sent via a request header.
-	KeyTypeHeaderAPI KeyType = "header_api"
-	// KeyTypeOAuth2 holds OAuth2 client credentials (client_id / client_secret).
-	KeyTypeOAuth2 KeyType = "oauth2"
-	// KeyTypeGenericAPI is a generic application API key.
-	KeyTypeGenericAPI KeyType = "api"
-)
-
-// UserKey represents a single named auth key belonging to a user.
-// KeyHash stores the SHA-256 hex digest of the raw key; the raw key is never persisted.
-type UserKey struct {
-	ID         int64          `json:"id"`
-	UserID     int            `json:"user_id"`
-	KeyType    KeyType        `json:"key_type"`
-	KeyHash    string         `json:"key_hash"` // SHA-256 hex; never the raw key
-	Name       string         `json:"name"`
-	Scopes     []string       `json:"scopes,omitempty"`
-	Meta       map[string]any `json:"meta,omitempty"`
-	ExpiresAt  *time.Time     `json:"expires_at,omitempty"`
-	CreatedAt  time.Time      `json:"created_at"`
-	LastUsedAt *time.Time     `json:"last_used_at,omitempty"`
-	IsActive   bool           `json:"is_active"`
-}
-
-// CreateKeyRequest specifies the parameters for a new key.
-type CreateKeyRequest struct {
-	UserID    int
-	KeyType   KeyType
-	Name      string
-	Scopes    []string
-	Meta      map[string]any
-	ExpiresAt *time.Time
-}
-
-// CreateKeyResponse is returned exactly once when a key is created.
-// The caller is responsible for persisting RawKey; it is not stored anywhere.
-type CreateKeyResponse struct {
-	Key    UserKey
-	RawKey string // crypto/rand 32 bytes, base64url-encoded
-}
+// hashSHA256Hex is kept as a short alias for sectypes.HashKey inside this package.
+func hashSHA256Hex(raw string) string { return sectypes.HashKey(raw) }
 
 // KeyStore manages per-user auth keys with pluggable storage backends.
 // Implementations: ConfigKeyStore (static list) and DatabaseKeyStore (stored procedures).