dms: USAGE auf audit_log_id_seq fuer nexarch_app (Migration 0036), Test mit Schema-Rechten

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

dms/internal/audittrail/append_only_test.go

@@ -28,7 +28,7 @@ func setupAppendOnlyTest(t *testing.T) (*pgxpool.Pool, func()) {
 	}
 	ctx := context.Background()
 
-	pool := testdb.Pool(t, adminDSN)
+	pool, schema := testdb.PoolWithSchema(t, adminDSN, nil)
 	if _, err := pool.Exec(ctx, `
 		CREATE TABLE IF NOT EXISTS audit_log (
 			id BIGSERIAL PRIMARY KEY, occurred_at TIMESTAMPTZ NOT NULL DEFAULT now(), actor TEXT NOT NULL,
@@ -56,6 +56,8 @@ func setupAppendOnlyTest(t *testing.T) (*pgxpool.Pool, func()) {
 		REVOKE ALL ON audit_log FROM PUBLIC;
 		REVOKE ALL ON audit_log FROM nexarch_app;
 		GRANT INSERT, SELECT ON audit_log TO nexarch_app;
+		GRANT USAGE ON SEQUENCE audit_log_id_seq TO nexarch_app;
+		GRANT USAGE ON SCHEMA `+schema+` TO nexarch_app;
 	`); err != nil {
 		t.Fatalf("schema: %v", err)
 	}

dms/migrations/tenant/0036_audit_log_sequence_grant.down.sql

@@ -0,0 +1 @@
+REVOKE USAGE ON SEQUENCE audit_log_id_seq FROM nexarch_app;

dms/migrations/tenant/0036_audit_log_sequence_grant.up.sql

@@ -0,0 +1,6 @@
+-- Migration 0013 gibt nexarch_app nur INSERT/SELECT auf audit_log. Eine
+-- Login-Rolle, die Mitglied von nexarch_app, aber nicht Tabelleneigentuemerin
+-- ist, braucht fuer die BIGSERIAL-Spalte id zusaetzlich USAGE auf die
+-- Sequenz; sonst scheitert jeder INSERT mit "permission denied for sequence
+-- audit_log_id_seq".
+GRANT USAGE ON SEQUENCE audit_log_id_seq TO nexarch_app;