feat: establish NekoNest Cloud control and relay

drizzle/9002_ready_credential_reconciliation.sql

@@ -0,0 +1,21 @@
+DROP TRIGGER IF EXISTS `provisioning_queue_guard`;--> statement-breakpoint
+
+CREATE TRIGGER `provisioning_queue_guard`
+BEFORE INSERT ON `provisioning_operations`
+WHEN NEW.`status` = 'requested'
+BEGIN
+  SELECT CASE WHEN NOT EXISTS (
+    SELECT 1
+    FROM `tenant_instances`
+    WHERE `id` = NEW.`tenant_id`
+      AND `desired_generation` + 1 = NEW.`target_generation`
+      AND `credential_revision` = NEW.`credential_revision`
+      AND `tombstoned_at` IS NULL
+      AND (
+        (NEW.`operation` = 'ensure' AND `lifecycle` IN ('requested', 'ready', 'failed', 'degraded'))
+        OR (NEW.`operation` = 'suspend' AND `lifecycle` IN ('ready', 'degraded'))
+        OR (NEW.`operation` = 'resume' AND `lifecycle` IN ('suspended', 'failed'))
+        OR (NEW.`operation` = 'deprovision' AND `lifecycle` IN ('requested', 'ready', 'suspended', 'failed', 'degraded'))
+      )
+  ) THEN RAISE(ABORT, 'invalid_provisioning_transition') END;
+END;