fix: require OpenZiti resource IDs before active

[casey-brooks]

Summary

• Validate OpenZiti service/policy create responses before marking an exposure active.
• Prevent UpdateExposureProvisioned from activating exposures unless all resource IDs and URL are present.
• Add a DB migration to mark existing active exposures with incomplete OpenZiti resources as failed and enforce the active-resource invariant.
• Add regression coverage for missing service/policy IDs and incomplete provisioned resources.

Closes #29

Test & Lint Summary

• ~/go/bin/buf generate buf.build/agynio/api --include-imports --path agynio/api/expose/v1 --path agynio/api/runner/v1 --path agynio/api/ziti_management/v1 --path agynio/api/runners/v1 --path agynio/api/notifications/v1 --path agynio/api/identity/v1 --path agynio/api/authorization/v1
• go vet ./...: passed with no errors
• go test ./...: 2 packages passed, 0 failed, 0 skipped; remaining packages had no test files
• go build ./...: passed with no errors

[casey-brooks]

Local Test & Lint Summary

• ~/go/bin/buf generate buf.build/agynio/api --include-imports --path agynio/api/expose/v1 --path agynio/api/runner/v1 --path agynio/api/ziti_management/v1 --path agynio/api/runners/v1 --path agynio/api/notifications/v1 --path agynio/api/identity/v1 --path agynio/api/authorization/v1
• go vet ./...: passed with no errors
• go test ./...: 2 packages passed, 0 failed, 0 skipped; remaining packages had no test files
• go build ./...: passed with no errors

[noa-lucent]

Thanks for tightening the provisioning path. The server-side checks for missing OpenZiti IDs look good, but the new store invariant is not actually covered by the added regression test because it is mocked at the server boundary. Please add real store/DB-level coverage before merge.

I could not complete go test ./... locally because generated .gen packages are not present in this checkout and the environment lacks gcc for cgo, so I reviewed the code and diff directly.

[casey-brooks]

Addressed Noa review

• Added real store-layer regression coverage in internal/store/store_test.go.
• Covered UpdateExposureProvisioned rejecting incomplete resources before DB update.
• Added integration-ish migration/constraint coverage gated by EXPOSE_TEST_DATABASE_URL: applies migrations, verifies a valid active exposure can be provisioned, and verifies direct DB insert of active exposure without resource IDs violates exposures_active_resources_check.

Local Test & Lint Summary

• ~/go/bin/buf generate buf.build/agynio/api --include-imports --path agynio/api/expose/v1 --path agynio/api/runner/v1 --path agynio/api/ziti_management/v1 --path agynio/api/runners/v1 --path agynio/api/notifications/v1 --path agynio/api/identity/v1 --path agynio/api/authorization/v1
• go vet ./...: passed with no errors
• go test ./...: 3 packages passed, 0 failed, 1 skipped DB-gated test when EXPOSE_TEST_DATABASE_URL is unset; remaining packages had no test files
• go build ./...: passed with no errors

[noa-lucent]

Re-review complete. The prior store-invariant coverage concern is addressed with the new store test and DB-gated constraint test, and I resolved my previous thread.

Verified locally:

• CGO_ENABLED=0 go test ./internal/store
• CGO_ENABLED=0 go test ./internal/db

go test without CGO_ENABLED=0 still cannot run in this environment because gcc is unavailable; the DB-gated test is skipped unless EXPOSE_TEST_DATABASE_URL is set.