chore(db): drop Phase-A NIP-FI relay-side authority ledger

[wpfleger96]

Removes the dead relay-side authority ledger introduced by migrations 0041 and 0042, and the dead require_attested_key verifier knob from buzz-auth. Both are unreachable by design under NIP-FI spec v2 (#7214, squash d4420eb47), which makes OSS Buzz stateless for identity: the relay neither stores nor verifies an authority chain.

What changes

migrations/0044_drop_nip_fi_ledger.sql
Drops all fifteen NIP-FI ledger tables and their trigger functions using CASCADE to resolve the circular deferred FK between identity_bindings and identity_lifecycle_history. Drops proceed in FK dependency order: selectors → history/bindings → enrollment_policies/receipts → parallel drop of auth tables. Restores community_write_fence_excluded_table to its pre-0041 body (removes NIP-FI table names from the exclusion array).

schema/schema.sql
Removes the NIP-FI section (~1885 lines of tables, functions, and triggers) and updates community_write_fence_excluded_table to match.

crates/buzz-db/src/runtime/migration.rs

• Updates the embedded_migrator_contains_consolidated_initial_schema sanity check: count 43→44, adds 0044 assertion block (verifies DROP TABLE statements and absence of NIP-FI names from schema.sql).
• Removes ~2580 lines of NIP-FI Postgres integration tests (all #[tokio::test] #[ignore = "requires Postgres"] from the 0041/0042 behavioral coverage).
• Removes the extract_excluded_table_array drift check (0042 body no longer matches schema.sql by design).
• Adds migration_0044_drops_populated_nip_fi_ledger_cleanly: runs migrations to 0042, seeds rows in authorization_operation_receipts and authorization_invalidation_domains, then runs to 0044 and verifies all fifteen NIP-FI tables are absent.

crates/buzz-auth/src/nip_fi/config.rs
Removes require_attested_key: bool from IssuerPolicy — field, constructor parameter, accessor, and its contribution to derive_assertion_policy_id.

crates/buzz-auth/src/nip_fi/verifier.rs
parse_nostr_pubkey_claim no longer takes a policy parameter. The None (absent claim) arm now returns Err(VerifierError::ClaimRejected) unconditionally instead of conditionally on policy.require_attested_key().

crates/buzz-auth/src/nip_fi/verifier/tests.rs

• Removes missing_nostr_pubkey_denies_under_attested_key_policy (the sole require_attested_key: true call site).
• Removes false, from all eleven IssuerPolicy::new call sites.
• Injects nostr_pubkey by default in mint_signed_by (spec v2 requires it unconditionally).
• Updates valid_access_token_verifies to assert asserted_key().is_some().

crates/buzz-auth/src/nip_fi/startup/tests.rs + jwks/tests.rs
Removes false, from all IssuerPolicy::new call sites and adds nostr_pubkey to all token-minting helpers.

Verification

• Fresh-DB migration run to head: all migrations apply cleanly in sequence.
• Populated-0041/0042-DB migration through 0044: seeds rows in live NIP-FI tables, verifies all fifteen are dropped without error.

Closes the dead-code inventory item from the spec-v2 cleanup plan (channel 48374f48). Follows #7214.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 1c8321cd08feb597f8bcff5195c21148fb3e98ed...47e90958888e80a86190c813dd45836d00bfae0f
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability regressions found. The verifier now rejects missing nostr_pubkey claims unconditionally and changes the policy fingerprint. The database migration removes only the unused NIP-FI ledger objects and restores the prior community-fence exclusion set.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• No additional limitations were reported.

---

_{Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run}