feat(repository): implement user repository (#10967)

## Summary

This PR introduces the relational user repository for backend v3,
including schema, repository APIs, reducers/projections, and tests for
both human and machine users.

## What changed

* Added user-focused relational migrations (users, verifications,
metadata, PATs, machine keys, passkeys, identity provider links) and
related FK wiring.
* Implemented/expanded repository domain contracts and storage
implementations for human and machine user flows.
* Added support for machine secret handling and aligned access token
type modeling.
* Extended user domain models (verifications, password/email/phone/TOTP
state, passkeys, metadata, invite handling, identity provider links).
* Updated projection/reduction coverage and integration tests for key
user lifecycle events.
* Regenerated and updated mocks/enums plus supporting database
change/column utilities.

## Notes for reviewers

* This PR is large because it establishes the foundational relational
user storage layer and related test scaffolding. Sorry for that.

## Closes

Closes #10218
Closes #10224
Closes #10225
Closes #10209
Closes #10802

---------

Co-authored-by: Iraq Jaber <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>

backend/v3/storage/database/events_testing/authorization_test.go

@@ -435,6 +435,8 @@ func TestServer_AuthorizationReduces(t *testing.T) {
 }
 
 func createAndEnsureAuthorization(t *testing.T, instanceID, orgID, userID, projectID string, roles []string, retryDuration time.Duration, tick time.Duration) *authorization_v2.CreateAuthorizationResponse {
+	t.Helper()
+
 	// create authorization
 	createdAuthorization, err := AuthorizationClient.CreateAuthorization(CTX, &authorization_v2.CreateAuthorizationRequest{
 		UserId:         userID,
@@ -454,11 +456,13 @@ func createAndEnsureAuthorization(t *testing.T, instanceID, orgID, userID, proje
 		assert.Equal(collect, domain.AuthorizationStateActive, az.State)
 		assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime().UTC(), az.CreatedAt.UTC())
 		assert.Equal(collect, createdAuthorization.GetCreationDate().AsTime().UTC(), az.UpdatedAt.UTC())
-	}, retryDuration, tick, "authorization not found within %v: %v", retryDuration, err)
+	}, retryDuration, tick, "authorization %q not found within %v: %v", createdAuthorization.Id, retryDuration, err)
 	return createdAuthorization
 }
 
 func prepareProjectAndProjectRoles(t *testing.T, orgID string, roles []string) string {
+	t.Helper()
+
 	project, err := ProjectClient.CreateProject(CTX, &project_v2beta.CreateProjectRequest{
 		OrganizationId: orgID,
 		Name:           integration.ProjectName(),
@@ -477,7 +481,7 @@ func prepareProjectAndProjectRoles(t *testing.T, orgID string, roles []string) s
 			projectRepo.PrimaryKeyCondition(Instance.ID(), project.Id),
 		))
 		require.NoError(collect, err)
-	}, retryDuration, tick, "project not found")
+	}, retryDuration, tick, "project %q not found within %v: %v", project.Id, retryDuration, err)
 
 	for _, role := range roles {
 		_, err = ProjectClient.AddProjectRole(CTX, &project_v2beta.AddProjectRoleRequest{

backend/v3/storage/database/events_testing/idp_intent_test.go

@@ -2,7 +2,7 @@
 
 package events_test
 
-// TODO(adlerhurst): Uncomment once users table is created and FK can be enforced
+// The tests of this file fail because we would need to mock an ldap, OIDC and Oauth server.
 
 // import (
 // 	"net"

backend/v3/storage/database/events_testing/session_test.go

@@ -325,7 +325,7 @@ func TestServer_SessionReduces(t *testing.T) {
 				Metadata:  metadata,
 				UserAgent: userAgent,
 			}, dbSession)
-		}, retryDuration, tick, "session not found within %v: %v", retryDuration, err)
+		}, retryDuration, tick, "session %q not found within %v: %v", createdSession.GetSessionId(), retryDuration, err)
 	})
 
 	t.Run("checks with challenges set reduces", func(t *testing.T) {