New: Drop legacy access fields (_isShared/_shareWithUsers/userGroups) — contract step

[taylortom]

Context

Final contract step of the generic _access migration — see adapt-security/adapt-authoring-api#98 (migration step 4). Runs only after the enforcement switch + UI patches have shipped and the new _access.* reads are verified in production.

Summary

A DataMigration to drop the now-unused legacy access fields once all reads/writes use _access.*:

• _isShared, _shareWithUsers (content / courses)
• userGroups (content / courses + assets) — coordinate with usergroups, which owns that mapping

Caveats

• Sequence after the switch. Dropping legacy fields before the new reads + both UIs are live reopens the access-gap window (Import hooks not running on UI import #98). Do not run early.
• Replica-set / DDL. $unset of fields is a data mutation (safe under the migration runner's transactions). But if any indexes exist on these fields, dropping an index is DDL and fails on replica sets / Atlas (see the adapt-authoring-migrations transaction gap). Check for and drop such indexes outside the transacted migration.
• Idempotent. Scope each .where(...) to docs that still carry a legacy field.

Dependencies

• Requires the switch release (UI widgets + enforcement) to be live and verified.

[taylortom]

Blocked by #194. This contract step must only run once #194 (swap enforcement to generic _access) is live and verified in production — until then the legacy fields (_isShared/_shareWithUsers/userGroups) are still the enforcement source and dropping them would remove access control.