feat(identity): handles Wave A1 — owners namespace + claim API (migration 0022)

[unforced]

Handles Wave A1 (of the ratified handles/sharing plan) — the GitHub owner-model groundwork on the identity worker. Dark and inert: nothing serves or advertises a /u/<handle> URL yet (Waves B–D), so an account without a handle is byte-for-byte unaffected. One additive field is the only wire change.

What ships

• Migration 0022 (workers/identity/migrations/0022_owners.sql) — ⚠️ prod-migration-bearing:
  • owners(owner_id PK, handle TEXT NOT NULL UNIQUE, kind CHECK(user|org), claimed_at) — the one namespace users + orgs share.
  • users.owner_id (nullable — claiming is optional + Settings-initiated).
  • idx_users_owner partial unique index (WHERE owner_id IS NOT NULL) — ONE handle per account at the DB.
  • Follows 0020's idempotence posture (plain statements; the D1 migration runner never re-applies).
• src/handles.ts — HANDLE_RE ([a-z0-9-]{3,30}, no leading/trailing hyphen), the reserved list (plan §5 union), suggestHandleFromEmail (pure; always returns a valid non-reserved handle), and claimHandle (validate → reserved → claim-once → atomic INSERT owners + UPDATE users; UNIQUE race → HandleTakenError, mirroring VaultNameTakenError at vaults.ts:177).
• Bearer endpoints (src/account-api.ts, wired in index.ts):
  • GET /account/handle (read) → { handle, suggested }
  • GET /account/handle/check?handle= (read) → { available, reason? }
  • POST /account/handle (admin) → claim-once; 409 handle_already_set if already set
  • /account/summary gains additive handle: string|null. Nothing else on the wire changes.
• users.User gains ownerId (additive) so requireAccount's loaded user carries the handle-owner pointer.

Gates

• workers/identity typecheck: clean
• workers/identity vitest: 874 passed / 0 failed — run in batches; the local workerd pool exhausts loopback sockets running all 35 files at once (worker-startup crashes, zero assertion failures; the 3 changed files run clean together at 108).
• root bun run typecheck: clean · root bun test: 153 pass / 0 fail
• New coverage: test/migration-0022.test.ts (owners constraints + partial index), test/handles.test.ts (validation table, reserved, suggestion, claim-once, the race), test/account-api.test.ts additions (all 3 endpoints + scope enforcement + the summary field). Synthetic data only.

Judgment calls (for the reviewer)

• The handle RE strictens the ratified charset to forbid leading/trailing hyphens (GitHub does the same) — one line to relax if unwanted.
• Short reserved words (u, me, my, id) are shape-rejected as invalid before the reserved check, since the RE's 3-char floor precedes it. They still fail the claim; the reserved set lists them as defense-in-depth if the shape rule ever loosens.
• /account/handle/check stays behind the account bearer per the plan, though availability is public info (GitHub-style).
• claimHandle pre-checks owner_id then guards the batch UPDATE with owner_id IS NULL; a same-user concurrent claim of the same handle is caught cleanly by owners.handle UNIQUE (the realistic double-submit). Documented in the function.

Merges AFTER any in-flight PR; rebased onto origin/main (rc.100) and bumped to rc.101.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB