feat: shared organization ingestion datasets and import history
Organization data imports need a queryable home in Recoup's existing database. This adds shared organization-owned datasets, immutable import versions and validated gold rows, with no database or schema per client.
The service-only database gateway rechecks and locks organization membership on every transaction. Browser and service roles have no direct table access; all three tables have RLS enabled. Gold rows and completion receipts commit atomically, retries must match the original payload, and list/record reads require explicit organization and import scope. Originals remain in private Storage.
Validation: twelve database tests pass on disposable PostgreSQL 17, plus a joined test running the matching API parser and processing entry point against the real migration. Coverage includes exact decimal/identifier strings, concurrent retries, immutable versions, denied cross-org access, membership revocation, private table/function grants, pagination and rollback. Record pages also have a 2 MiB payload budget, with controlled errors for oversized individual rows. The joined test recovers a committed completion with a lost acknowledgement without duplicate rows. CI exercises PostgreSQL 15 and 17.
Rollout: apply both additive migrations to the existing Recoup project before the dependent API consumer. Keep ingestion disabled pending hosted qualification. No hosted migration, new client database or production intake is activated. See tests/INGESTION-CATALOG.md for the dependency boundary and rollback order.
API consumer: API PR #1240. Read-only inspection of the Supabase PR preview confirms RLS on all three tables, no direct browser/service table reads, and service-only execution of the catalog gateway. The worker verifies the private artifact byte digest; SQL separately fingerprints the received result and gold objects for idempotency. The granted SQL gateway keeps organization authorization and write/receipt atomicity explicit; already-applied migrations are preserved with forward-only corrections.
Inline-read boundary: the 2 MiB budget covers record payloads, with bounded field-type metadata added to the response. Oversized individual gold rows remain retained and return a controlled size error on inline read; large-object export is a documented future extension. Remaining reviewer suggestions to reject those rows at storage time or further split the gateway are left for human disposition, rather than changing the documented retention/read-capacity contract in this PR.
Final status on d0262c7: every CI check passes, including the twelve catalog SQL tests on PostgreSQL 15/17, existing database regression jobs and Supabase PR preview. The read-only preview audit also confirms the forward page-budget correction is installed and catalog execution is denied to anonymous/authenticated roles. Production ingestion remains disabled; no production migration was manually applied. Merge/release order is Database #133, then API #1240, followed by hosted API/Storage/Workflow qualification before activation.