feat: harden data access and simplify user management

app/data_platform/mysql_service.py

@@ -276,6 +276,26 @@ async def ensure_platform_registry() -> bool:
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci
         """,
         """
+        CREATE TABLE IF NOT EXISTS dbeaver_access_grants (
+            id CHAR(36) PRIMARY KEY,
+            display_name VARCHAR(100) NOT NULL,
+            mysql_username VARCHAR(32) NOT NULL UNIQUE,
+            database_id VARCHAR(63) NOT NULL,
+            database_name VARCHAR(64) NOT NULL,
+            permission_level VARCHAR(16) NOT NULL,
+            ssh_key_type VARCHAR(32) NOT NULL,
+            ssh_public_key TEXT NOT NULL,
+            ssh_key_fingerprint VARCHAR(100) NOT NULL,
+            created_by VARCHAR(191) NOT NULL,
+            status VARCHAR(16) NOT NULL DEFAULT 'active',
+            revoked_at DATETIME(6) NULL,
+            created_at DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+            KEY idx_dbeaver_access_status (status, created_at),
+            KEY idx_dbeaver_access_database (database_id, status),
+            KEY idx_dbeaver_access_fingerprint (ssh_key_fingerprint, status)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci
+        """,
+        """
         CREATE TABLE IF NOT EXISTS api_clients (
             id CHAR(36) PRIMARY KEY,
             name VARCHAR(100) NOT NULL,