feat(BA-6628): move fragment rank to the allow list with scope defaults

[jopemachine]

Summary

Applies the review feedback on the AppConfigFragment stack. Replaces #12429 — the conditional-bulk repository primitives are dropped from the stack; the rank redesign lands first instead. Split for review into three PRs: this one (DB/model rank move), #12517 (API surface), and #12518 (FK + cascade).

• rank moves from app_config_fragments to app_config_allow_list. Fragment writes are partly user-owned (an allow-listed user manages their own user-scope fragment), so a rank on the fragment would let the owner re-order the merge. Merge priority is admin policy — it now lives on the admin-owned allow-list entry, and fragments carry no rank of their own.
• Scope-type default ranks. A new allow-list entry defaults its rank by scope type — public=100, domain=200, user=300 — so a user's own fragment wins the merge by default; an explicit rank may be passed through AppConfigAllowListCreatorSpec (API exposure comes in feat(BA-6628): expose allow-list rank on the v2 API surface #12517).
• Fragment create simplification. The per-config_name next-value rank assignment (NextValuePolicy, lock on the definition row) is gone; AppConfigFragmentCreatorSpec becomes a plain CreatorSpec. The allow-list write gates are untouched here (feat(BA-6628): cascade fragment deletion from the allow list #12518 revisits them together with the FK).
• Migration 66d0f891ed20: adds app_config_allow_list.rank (backfilled by scope-type default) and drops app_config_fragments.rank. Downgrade restores fragment ranks from their allow-list entry (scope-type default fallback for orphans). Verified up/down against a local DB with seeded data.
• BEP-1052 updated: rank placement, scope-type defaults, and the revised read-merge description.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. 👉 feat(BA-6628): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6628): move fragment rank to the allow list with scope defaults (replaces feat(BA-6628): conditional-bulk repository primitives #12429) ← you are here
7. feat(BA-6628): expose allow-list rank on the v2 API surface #12517 — feat(BA-6628): expose allow-list rank on the v2 API surface
8. feat(BA-6628): cascade fragment deletion from the allow list #12518 — feat(BA-6628): cascade fragment deletion from the allow list
9. feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
10. feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): AppConfigFragment bulk CRUD service layer
11. feat(BA-6555): add app_config service layer #12359 — feat(BA-6555): app_config service layer (merge engine)
12. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API

🤖 Generated with Claude Code