feat: 레거시 재이관과 계정 복구 기반을 추가

중앙 이전 기록 스키마와 버전 정규화기를 도입하고, 재실행 시 현행 계정 상태를 보존한다. 카카오 인증 뒤 이관 비밀번호를 1회 설정하는 흐름과 비카카오 계정용 안전한 CLI 복구 경로를 추가한다.

app/gateway-api/src/auth/localAccountPolicy.ts

@@ -35,7 +35,9 @@ export const hasActiveSpecialAccountGrant = (
     grants: readonly SpecialAccountAccessGrantRecord[],
     now: Date = new Date()
 ): boolean =>
-    grants.some((grant) => !grant.revokedAt && (!grant.expiresAt || new Date(grant.expiresAt).getTime() > now.getTime()));
+    grants.some(
+        (grant) => !grant.revokedAt && (!grant.expiresAt || new Date(grant.expiresAt).getTime() > now.getTime())
+    );
 
 const appliesToProfile = (grant: SpecialAccountAccessGrantRecord, profile: string, profileName: string): boolean =>
     grant.profiles.length === 0 || grant.profiles.includes(profile) || grant.profiles.includes(profileName);
@@ -67,9 +69,7 @@ const resolveSpecialAccess = (options: {
     const selected = active.find((grant) => grant.allowsGeneralCreation) ?? active[0]!;
     const expiresAt = active.some((grant) => !grant.expiresAt)
         ? null
-        : active
-              .map((grant) => grant.expiresAt!)
-              .sort((left, right) => right.localeCompare(left))[0] ?? null;
+        : (active.map((grant) => grant.expiresAt!).sort((left, right) => right.localeCompare(left))[0] ?? null);
     return {
         kind: selected.kind,
         grantId: selected.id,
@@ -98,7 +98,10 @@ export const resolveLocalAccountProfilePolicy = (options: {
         'localAccountGeneralCreationGraceDays',
         generalCreationDefault
     );
-    const kakaoVerified = options.user.oauthType === 'KAKAO' && Boolean(options.user.kakaoVerifiedAt);
+    const kakaoVerified =
+        options.user.oauthType === 'KAKAO' &&
+        Boolean(options.user.oauthId?.trim()) &&
+        Boolean(options.user.kakaoVerifiedAt);
     const graceStartedAt = new Date(options.user.kakaoGraceStartedAt);
     const now = options.now ?? new Date();
     const specialAccess = resolveSpecialAccess({
@@ -116,7 +119,9 @@ export const resolveLocalAccountProfilePolicy = (options: {
     const generalCreationEndsAt = new Date(graceStartedAt.getTime() + generalCreationGraceDays * DAY_MS);
     const accessAllowed = kakaoVerified || specialAccess !== null || now < accessEndsAt;
     const canCreateGeneral =
-        kakaoVerified || specialAccess?.allowsGeneralCreation === true || (accessAllowed && now < generalCreationEndsAt);
+        kakaoVerified ||
+        specialAccess?.allowsGeneralCreation === true ||
+        (accessAllowed && now < generalCreationEndsAt);
 
     return {
         requiresKakaoVerification: !kakaoVerified && specialAccess === null,