chore: delete retired guests, refresh the schema snapshot, document non-rolling upgrades

[darwin67]

Summary

Three follow-ups left over from the design stack, #63–#69.

1. Delete retired guest users (20261012090000)
RetireGuestUsers hid guest content and left the user rows "until a later cleanup". This migration is that cleanup.

• Deleting a guest user cascades to its personal organization, workspace, memberships and tokens.
• Pastes block workspace deletion, so they are removed first.
  • Inline pastes live only in Postgres. The migration deletes them, which is all the cleaner would do for them.
  • Pastes with a storage key have an object the migration can't reach. They stay for the cleaner, and their guest is skipped.
• Where the cleaner has run since the retirement migration, nothing is skipped. It purges marked workspaces every 15 minutes.
• Can't be undone.

2. Regenerate priv/repo/structure.sql on PostgreSQL 17
The snapshot hadn't been dumped since #59, so it was missing every migration from #63 on. I regenerated it with mix ecto.migration against PG 17.11, the major version CI runs. One change isn't from a migration: pending_uploads now lists claimed_at before inserted_at, which is the order its migration creates. The column types are the same.

3. Upgrade guidance in docs/self-hosting.md
The upgrade guide promised that every migration was safe during a rolling deploy. Two aren't, and each instance runs its own cleaner, so one old instance left running is enough to cause trouble:

• Paste lifecycle: older code treats a paste as live unless it has expired. It would show deleted pastes, and its cleaner would hard-delete expired pastes that are still restorable.
• Guest retirement: older code still creates guest accounts, and any created afterwards would never be retired.

The guide now says to stop every old instance before running /app/bin/migrate for these two. It also notes which migrations can't be undone.

Deploying this to an existing install

The safe sequence:

1. The lifecycle and guest-retirement migrations are deployed with old instances stopped first.
2. The new cleaner has run at least once.
3. This PR is deployed with a normal rollout.

Test plan

• Migration test covers three accounts:
  • A guest with an inline paste is deleted, along with its organization and workspace.
  • A guest with a stored paste is kept, and so is the paste.
  • A registered account is untouched.
• mix test: 564 tests, 0 failures. mix credo reports no issues. mix compile --warnings-as-errors is clean.
• The snapshot was generated by running every migration on a fresh PostgreSQL 17 database.

🤖 Generated with Claude Code

https://claude.ai/code/session_019fnjMN7WpEjQJD2zveakV6

---

Generated by Claude Code

[darwin67]

Oracle review complete: signed off after correcting contradictory upgrade guidance. Guest retirement still requires stopping all old instances. The later guest-deletion migration supports normal rolling deployment only when all running instances already use guest-free, lifecycle-aware code. Clarified that storage-backed guests skipped by the migration remain pending a later user cleanup even after the cleaner purges their pastes. Strengthened the migration test: fixtures now predate retirement, retained guests have deletion markers/expired pastes/revoked tokens, and registered accounts remain unaffected. No migration SQL or schema snapshot changes were required by review. Validation: mix precommit (564 ExUnit tests plus JS tests) and mix credo passed. Corrections committed and pushed without rewriting published history. No production migration or deployment was triggered. Review session: https://ampcode.com/threads/T-01a12594-e2f1-75be-b343-9239564f5c84

Post-push CI is green: memory/local/S3 Elixir tests, Rust tests, formatting/linting, and production-container build all passed. Release/publication jobs skipped as expected.