feat(gateway): add special account access

packages/common/src/auth/gameToken.ts

@@ -55,6 +55,10 @@ export interface GameSessionTokenPayload {
         canCreateGeneral: boolean;
         requiresKakaoVerification: boolean;
         graceEndsAt: string | null;
+        specialAccess?: {
+            kind: 'OPERATOR' | 'TESTER' | 'RECOVERY' | 'OTHER';
+            expiresAt: string | null;
+        };
     };
 }
 
@@ -136,7 +140,13 @@ export const parseGameSessionTokenPayload = (value: unknown): GameSessionTokenPa
             typeof identity.kakaoVerified !== 'boolean' ||
             typeof identity.canCreateGeneral !== 'boolean' ||
             typeof identity.requiresKakaoVerification !== 'boolean' ||
-            (identity.graceEndsAt !== null && typeof identity.graceEndsAt !== 'string')
+            (identity.graceEndsAt !== null && typeof identity.graceEndsAt !== 'string') ||
+            (identity.specialAccess !== undefined &&
+                (!identity.specialAccess ||
+                    typeof identity.specialAccess !== 'object' ||
+                    !['OPERATOR', 'TESTER', 'RECOVERY', 'OTHER'].includes(identity.specialAccess.kind) ||
+                    (identity.specialAccess.expiresAt !== null &&
+                        typeof identity.specialAccess.expiresAt !== 'string')))
         ) {
             return null;
         }

packages/infra/prisma/gateway-migrations/20260808001000_add_special_account_access_grants/migration.sql

@@ -0,0 +1,32 @@
+DO $$
+BEGIN
+    CREATE TYPE "SpecialAccountAccessKind" AS ENUM ('TESTER', 'RECOVERY', 'OTHER');
+EXCEPTION
+    WHEN duplicate_object THEN NULL;
+END $$;
+
+CREATE TABLE IF NOT EXISTS "special_account_access_grant" (
+    "id" UUID NOT NULL DEFAULT gen_random_uuid(),
+    "user_id" TEXT NOT NULL,
+    "kind" "SpecialAccountAccessKind" NOT NULL,
+    "profiles" TEXT[] NOT NULL DEFAULT ARRAY[]::TEXT[],
+    "allows_general_creation" BOOLEAN NOT NULL DEFAULT TRUE,
+    "expires_at" TIMESTAMP(3),
+    "reason" TEXT NOT NULL,
+    "granted_by_user_id" TEXT NOT NULL,
+    "revoked_at" TIMESTAMP(3),
+    "revoked_by_user_id" TEXT,
+    "revoked_reason" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "special_account_access_grant_pkey" PRIMARY KEY ("id"),
+    CONSTRAINT "special_account_access_grant_user_id_fkey"
+        FOREIGN KEY ("user_id") REFERENCES "app_user"("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS "special_account_access_grant_user_id_revoked_at_expires_at_idx"
+    ON "special_account_access_grant"("user_id", "revoked_at", "expires_at");
+CREATE INDEX IF NOT EXISTS "special_account_access_grant_kind_created_at_idx"
+    ON "special_account_access_grant"("kind", "created_at");
+
+COMMENT ON TABLE "special_account_access_grant" IS
+    'Explicit audited exception allowing selected local accounts to enter game profiles without Kakao verification.';

packages/infra/prisma/gateway.prisma

@@ -65,6 +65,12 @@ enum AdminAuditOutcome {
   FAILED
 }
 
+enum SpecialAccountAccessKind {
+  TESTER
+  RECOVERY
+  OTHER
+}
+
 enum GatewaySourceMode {
   BRANCH
   COMMIT
@@ -101,10 +107,31 @@ model AppUser {
   lastLoginAt            DateTime?  @map("last_login_at")
   legacyData             Json       @default(dbgenerated("'{}'::jsonb")) @map("legacy_data")
   icons                  UserIcon[]
+  specialAccessGrants    SpecialAccountAccessGrant[]
 
   @@map("app_user")
 }
 
+model SpecialAccountAccessGrant {
+  id                    String                   @id @default(uuid())
+  userId                String                   @map("user_id")
+  user                  AppUser                  @relation(fields: [userId], references: [id], onDelete: Cascade)
+  kind                  SpecialAccountAccessKind
+  profiles              String[]                 @default([])
+  allowsGeneralCreation Boolean                  @default(true) @map("allows_general_creation")
+  expiresAt             DateTime?                @map("expires_at")
+  reason                String
+  grantedByUserId       String                   @map("granted_by_user_id")
+  revokedAt             DateTime?                @map("revoked_at")
+  revokedByUserId       String?                  @map("revoked_by_user_id")
+  revokedReason         String?                  @map("revoked_reason")
+  createdAt             DateTime                 @default(now()) @map("created_at")
+
+  @@index([userId, revokedAt, expiresAt])
+  @@index([kind, createdAt])
+  @@map("special_account_access_grant")
+}
+
 model AdminAuditEvent {
   id             String            @id @default(uuid())
   correlationId  String            @map("correlation_id")