fix(bff): require UPDATE in the pending-login managed-schema check

[ovander]

What and why

PostgresPendingLoginStore.Put is an INSERT … ON CONFLICT (state) DO UPDATE, which needs the UPDATE privilege on the table. But WithPendingLoginManagedSchema's start-up check verified only SELECT, INSERT and DELETE (a slip from #111). A role granted exactly those three passed the check, then failed every sign-in at Put. This was found while moving the monitoring console's BFF to the managed schema, and confirmed in psql.

• The check now also requires UPDATE, as the session store's check already does.
• The doc comment lists all four privileges and says why.

How it was tested

• New TestPostgresPendingLoginStore_ManagedSchemaNeedsUpdate:

  • uses a least-privilege role holding SELECT, INSERT, DELETE;
  • on a non-superuser it revokes UPDATE instead;
  • expects a start-up error naming UPDATE.

• Fails without the fix, passes with it. Run against a local Postgres 16 with TEST_DATABASE_URL set.

• go mod tidy && git diff --exit-code go.sum leaves go.sum unchanged

• go build ./... passes

• go vet ./... passes

• go test -race -count=1 -timeout=120s ./... passes

• golangci-lint run ./... (v2.14.0) reports no issue

• govulncheck ./...: not run locally (vuln.go.dev is blocked here); CI runs it. No dependency change.

• A line is added under ## [Unreleased] in CHANGELOG.md (### Fixed)

Compatibility

• Exported-API change: no.
• Behaviour change for existing callers:
  • With WithPendingLoginManagedSchema(), a role without UPDATE is now refused at start-up instead of failing at the first sign-in.
  • Such a configuration could not sign anyone in, so no working caller breaks.
• Breaking change: none.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA

---

Generated by Claude Code