[kcrmin]

Related: Idea2Strategy/Idea2Strategy-trading-engine#161 vendors the generated grants and runs the worker e2e tests under this role.

What and why

• DatabaseAccessPolicy.allowsTrading gave idea2strategy_trading SELECT, INSERT, UPDATE and DELETE on every operations table, operator credentials, sessions, RBAC and cases included.
• Every trading-engine statement that names operations lives in apps/trading-worker and touches three tables. The role now gets exactly that: SELECT and INSERT on outbox_messages, SELECT, INSERT and UPDATE on outbox_consumer_receipts, and INSERT on audit_events. Nothing deletes a receipt or rewrites an outbox row.
• The audit append uses on conflict (idempotency_key) do nothing, and PostgreSQL requires SELECT on the arbiter column. A new column-level grant gives SELECT on audit_events.idempotency_key only, instead of the whole audit trail. The existing table-level REVOKE still resets it on every run.
• Other schemas and other roles are unchanged.

Verified

• ./gradlew :db-migration:test --rerun --no-daemon --no-build-cache with Docker (colima): 41 tests, 0 skipped or failed. CentralFlywayIntegrationTest runs the worker's statement shapes as idea2strategy_trading and asserts that nine others, such as reading operator_login_credentials or deleting a receipt, fail with 42501.
• ./gradlew check --rerun-tasks --no-daemon --no-build-cache, then check --continue: 1056 tests, 1 skipped, 2 failed. Both failures are in AccountClosurePersistenceIntegrationTest (account_legal_hold_release_after_apply), which depends on the current date and is fixed by test(account): pin legal hold applied_at #294; with test(account): pin legal hold applied_at #294's test file applied, all 17 tests in that class pass on this branch.
• Assembled the bundle with this branch at the root develop pins through :db-migration:run. Against trading-engine feat: filter sanctioned leaderboard owners #160, every V*.sql file is byte-identical and R__database_runtime_grants.sql differs only in the trading operations grants.

Checklist

• Grants derived from every trading-engine statement that names operations
• Allowed and denied statements checked against PostgreSQL as the role
• Generated grant SQL asserted exactly in DatabaseAccessPolicyTest
• Root db/flyway-ci-bundle refresh is listed as a follow-up after merge