refactor: remove GATEWAY_USER_TOKENS, fix review feedback

GATEWAY_USER_TOKENS never went to production — replaced entirely by
DB-backed user management via /api/admin/users and /api/tokens.

Removed:
- UserTokenConfig struct and GATEWAY_USER_TOKENS env var parsing
- user_tokens field from GatewayConfig
- GatewayChannel::new_multi_auth() constructor
- Env-var user migration block in main.rs (~90 lines)
- multi_tenant auto-detection from GATEWAY_USER_TOKENS (now runtime
  via db.has_any_users() in app.rs)

Review fixes (zmanian):
- User ID generation: UUID instead of display-name derivation (#1)
- Invitation accept moved to public router (no auth needed) (#3)
- libSQL get_invitation_by_hash aligned with postgres: filters
  status='pending' AND expires_at > now (#4)
- UUID parse: returns DatabaseError::Serialization instead of
  unwrap_or_default (#7)
- PostgreSQL SELECT * replaced with explicit column lists (#8)
- Sort order aligned (both backends use DESC) (#6)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

src/main.rs

@@ -591,97 +591,7 @@ async fn async_main() -> anyhow::Result<()> {
     let mut gateway_url: Option<String> = None;
     let mut sse_manager: Option<std::sync::Arc<ironclaw::channels::web::sse::SseManager>> = None;
     if let Some(ref gw_config) = config.channels.gateway {
-        // Migrate env-var users into DB on first run. If GATEWAY_USER_TOKENS is
-        // set and the users table is empty, insert the env-var users so they
-        // survive a switch to DB-backed auth.
-        if let (Some(user_tokens), Some(db)) = (&gw_config.user_tokens, &components.db) {
-            match db.has_any_users().await {
-                Ok(false) => {
-                    tracing::info!(
-                        "Migrating {} env-var users into database",
-                        user_tokens.len()
-                    );
-                    for (token, cfg) in user_tokens {
-                        use ironclaw::channels::web::auth::hash_token;
-                        let now = chrono::Utc::now();
-                        let user = ironclaw::db::UserRecord {
-                            id: cfg.user_id.clone(),
-                            email: None,
-                            display_name: cfg.user_id.clone(),
-                            status: "active".to_string(),
-                            created_at: now,
-                            updated_at: now,
-                            last_login_at: None,
-                            created_by: None,
-                            metadata: serde_json::json!({"source": "env_migration"}),
-                        };
-                        if let Err(e) = db.create_user(&user).await {
-                            tracing::warn!(
-                                user_id = cfg.user_id,
-                                "Failed to migrate user to DB: {}",
-                                e
-                            );
-                            continue;
-                        }
-                        let token_hash = hash_token(token);
-                        let prefix = if token.len() >= 8 {
-                            &token[..8]
-                        } else {
-                            token.as_str()
-                        };
-                        if let Err(e) = db
-                            .create_api_token(
-                                &cfg.user_id,
-                                "env-migrated",
-                                &token_hash,
-                                prefix,
-                                None,
-                            )
-                            .await
-                        {
-                            tracing::warn!(
-                                user_id = cfg.user_id,
-                                "Failed to migrate token to DB: {}",
-                                e
-                            );
-                        }
-                    }
-                    tracing::info!("Env-var user migration complete");
-                }
-                Ok(true) => {
-                    tracing::info!(
-                        "GATEWAY_USER_TOKENS is set but DB already has users — \
-                         env-var tokens will be checked first, DB tokens as fallback. \
-                         Consider removing GATEWAY_USER_TOKENS and managing users via \
-                         /api/admin/users and /api/tokens endpoints."
-                    );
-                }
-                Err(e) => {
-                    tracing::warn!("Could not check for existing users: {}", e);
-                }
-            }
-        }
-
-        // Build multi-user auth state if user_tokens is configured, else single-user.
-        let mut gw = if let Some(ref user_tokens) = gw_config.user_tokens {
-            use ironclaw::channels::web::auth::{MultiAuthState, UserIdentity};
-            let tokens = user_tokens
-                .iter()
-                .map(|(token, cfg)| {
-                    (
-                        token.clone(),
-                        UserIdentity {
-                            user_id: cfg.user_id.clone(),
-                            workspace_read_scopes: cfg.workspace_read_scopes.clone(),
-                        },
-                    )
-                })
-                .collect();
-            let auth = MultiAuthState::multi(tokens);
-            GatewayChannel::new_multi_auth(gw_config.clone(), auth)
-        } else {
-            GatewayChannel::new(gw_config.clone())
-        };
+        let mut gw = GatewayChannel::new(gw_config.clone());
         gw = gw.with_llm_provider(Arc::clone(&components.llm));
         if let Some(ref ws) = components.workspace {
             gw = gw.with_workspace(Arc::clone(ws));