feat(BA-6628): cascade fragment deletion from the allow list

[jopemachine]

Summary

Ties fragments to their allow-list entry with a composite FK and lets deletion cascade (BEP-1052 review feedback):

• Composite FK with ON DELETE CASCADE. app_config_fragments (config_name, scope_type) now references app_config_allow_list, so purging an allow-list entry drops every fragment written under it — a revoked value disappears from the merge in the same statement, with no orphaned fragments to clean up separately.
• Write-gate cleanup. With the FK in place, a fragment row can only exist while its allow-list entry does, so the only_if gates on fragment update/purge are provably dead and are removed (from the actions, service, repository, and db_source). The create gate stays — it surfaces the domain error (AppConfigFragmentWriteNotAllowed) instead of a raw FK violation.
• Migration a560420476b6: deletes orphaned fragments (rows whose entry was already removed — the same outcome the cascade would have produced), then creates the FK. No new index is needed: the fragments' unique constraint already prefixes (config_name, scope_type). Upgrade/downgrade and the live cascade were verified against a local DB.
• BEP-1052 updated: cascade semantics on allow-list purge, the simplified lock-down scenario (removing the grant now also drops the user fragments), and the create-only write gate.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. feat(BA-6628): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6628): move fragment rank to the allow list with scope defaults (replaces feat(BA-6628): conditional-bulk repository primitives #12429)
7. feat(BA-6628): expose allow-list rank on the v2 API surface #12517 — feat(BA-6628): expose allow-list rank on the v2 API surface
8. 👉 feat(BA-6628): cascade fragment deletion from the allow list #12518 — feat(BA-6628): cascade fragment deletion from the allow list ← you are here
9. feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
10. feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): AppConfigFragment bulk CRUD service layer
11. feat(BA-6555): add app_config service layer #12359 — feat(BA-6555): app_config service layer (merge engine)
12. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API

🤖 Generated with Claude Code

---

📚 Documentation preview 📚: https://sorna--12518.org.readthedocs.build/en/12518/

---

📚 Documentation preview 📚: https://sorna-ko--12518.org.readthedocs.build/ko/12518/