refactor(db): drop the runtime schema mirror

ensureDbCompatibility ran ALTER TABLE / CREATE TABLE IF NOT EXISTS on the
login, register, token and session paths, mirroring columns every
migration under prisma/migrations already creates. The entrypoint applies
those migrations before the server listens and stops the boot when one
fails, so the mirror never had work to do, and DDL on a request path
needs the table's owner: a connection that may only read and write rows
fails every login on it. Drop the module, its call sites and the mocks
that stubbed it out.

src/app/api/auth/login/__tests__/constant-work.test.ts

@@ -58,10 +58,6 @@ vi.mock("@/lib/rate-limit", () => ({
   refundRateLimit: vi.fn(async () => undefined),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/auth/hmac", () => ({
   hashToken: vi.fn(() => "aa".repeat(32)),
 }));

src/app/api/auth/login/__tests__/native-token.test.ts

@@ -61,10 +61,6 @@ vi.mock("@/lib/rate-limit", () => ({
   refundRateLimit: vi.fn(async () => undefined),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/auth/hmac", () => ({
   hashToken: vi.fn((raw: string) => `hashed:${raw}`),
 }));
@@ -90,7 +86,6 @@ import {
   checkAuthSurfaceRateLimit,
   rateLimitHeaders,
 } from "@/lib/rate-limit";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { auditLog } from "@/lib/auth/audit";
 import { createSession } from "@/lib/auth/session";
 
@@ -136,7 +131,6 @@ beforeEach(() => {
     ip: "203.0.113.1",
   } as never);
   vi.mocked(rateLimitHeaders).mockReturnValue({} as never);
-  vi.mocked(ensureDbCompatibility).mockResolvedValue(undefined);
   vi.mocked(auditLog).mockResolvedValue(undefined as never);
   vi.mocked(createSession).mockResolvedValue("session-id");
 });

src/app/api/auth/login/__tests__/route.test.ts

@@ -52,10 +52,6 @@ vi.mock("@/lib/rate-limit", () => ({
   rateLimitHeaders: vi.fn(() => ({})),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/auth/hmac", () => ({
   // Return a deterministic hex string that does NOT echo the raw
   // value — mirrors the real HMAC-SHA256 shape. The audit row's
@@ -88,7 +84,6 @@ import {
   checkAuthSurfaceRateLimit,
   rateLimitHeaders,
 } from "@/lib/rate-limit";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 
 const TYPED_EMAIL = "leaked-identifier@example.com";
 
@@ -117,7 +112,6 @@ beforeEach(() => {
     ip: "1.2.3.4",
   } as never);
   vi.mocked(rateLimitHeaders).mockReturnValue({} as never);
-  vi.mocked(ensureDbCompatibility).mockResolvedValue(undefined);
 });
 
 describe("POST /api/auth/login — auth.login.failed audit row (H-1)", () => {

src/app/api/auth/login/__tests__/trusted-device.test.ts

@@ -52,10 +52,6 @@ vi.mock("@/lib/rate-limit", () => ({
   refundRateLimit: vi.fn(async () => undefined),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/auth/hmac", () => ({ hashToken: vi.fn(() => "h") }));
 vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
 vi.mock("next/headers", () => ({

src/app/api/auth/login/route.ts

@@ -11,7 +11,6 @@ import {
 } from "@/lib/api-response";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { beginAccountLoginAttempt } from "@/lib/auth/login-throttle";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { NextRequest, NextResponse } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
@@ -59,8 +58,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     );
   }
 
-  await ensureDbCompatibility();
-
   const { data: body, error: jsonError } = await safeJson(request, {
     maxBytes: 64 * 1024,
   });

src/app/api/auth/mfa/verify/route.ts

@@ -27,7 +27,6 @@ import { apiHandler } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import { prisma } from "@/lib/db";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { finishLogin } from "@/lib/auth/login-response";
 import {
@@ -59,8 +58,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     });
   }
 
-  await ensureDbCompatibility();
-
   const { data: body, error: jsonError } = await safeJson(request, {
     maxBytes: 16 * 1024,
   });

src/app/api/auth/mfa/webauthn/verify/__tests__/route.test.ts

@@ -14,10 +14,6 @@ vi.mock("@/lib/db", () => ({
   prisma: { user: { findUnique: vi.fn() } },
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/rate-limit", () => ({
   checkAuthSurfaceRateLimit: vi.fn(),
   rateLimitHeaders: vi.fn(() => ({})),

src/app/api/auth/mfa/webauthn/verify/options/route.ts

@@ -16,7 +16,6 @@ import { apiHandler } from "@/lib/api-handler";
 import { apiError, apiSuccess } from "@/lib/api-response";
 import { parseJsonBody } from "@/lib/api/body";
 import { annotate } from "@/lib/logging/context";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { loadActiveChallenge } from "@/lib/auth/mfa/challenge";
 import { createMfaAuthenticationOptions } from "@/lib/auth/mfa/webauthn";
@@ -37,8 +36,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     });
   }
 
-  await ensureDbCompatibility();
-
   const parsed = await parseJsonBody(request, mfaWebauthnLoginOptionsSchema, {
     maxBytes: 16 * 1024,
     message: "Invalid request",

src/app/api/auth/mfa/webauthn/verify/route.ts

@@ -25,7 +25,6 @@ import {
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import { prisma } from "@/lib/db";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { finishLogin } from "@/lib/auth/login-response";
 import {
@@ -57,8 +56,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     });
   }
 
-  await ensureDbCompatibility();
-
   const { data: body, error: jsonError } = await safeJson(request, {
     maxBytes: 64 * 1024,
   });

src/app/api/auth/native/token/__tests__/route.test.ts

@@ -12,10 +12,6 @@ vi.mock("@/lib/db", () => ({
   prisma: { user: { findUnique: vi.fn() } },
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/rate-limit", () => ({
   checkAuthSurfaceRateLimit: vi.fn(),
   rateLimitHeaders: vi.fn(() => ({})),

src/app/api/auth/native/token/route.ts

@@ -26,7 +26,6 @@ import { apiHandler } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import { prisma } from "@/lib/db";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { isCookielessNativeCaller } from "@/lib/auth/native-client";
 import { isNativeClientRequest } from "@/lib/auth/issue-token";
@@ -74,8 +73,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     return invalidCode();
   }
 
-  await ensureDbCompatibility();
-
   // (3) Body — bounded, then the exact wire contract.
   const parsed = await parseJsonBody(request, nativeHandoffTokenSchema, {
     maxBytes: 16 * 1024,

src/app/api/auth/oidc/native/token/__tests__/route.test.ts

@@ -9,10 +9,6 @@ vi.mock("@/lib/db", () => ({
   prisma: { user: { findUnique: vi.fn() } },
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/rate-limit", () => ({
   checkAuthSurfaceRateLimit: vi.fn(),
   rateLimitHeaders: vi.fn(() => ({})),

src/app/api/auth/oidc/native/token/route.ts

@@ -29,7 +29,6 @@ import { apiHandler } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import { prisma } from "@/lib/db";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 import { isCookielessNativeCaller } from "@/lib/auth/native-client";
 import { isNativeClientRequest } from "@/lib/auth/issue-token";
@@ -80,8 +79,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     return invalidCode();
   }
 
-  await ensureDbCompatibility();
-
   // (3) Body — bounded, then the exact wire contract.
   const parsed = await parseJsonBody(request, oidcNativeTokenSchema, {
     maxBytes: 16 * 1024,

src/app/api/auth/passkey/login-verify/__tests__/native-token.test.ts

@@ -37,10 +37,6 @@ vi.mock("@/lib/rate-limit", () => ({
   checkAuthSurfaceRateLimit: vi.fn(),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/auth/hmac", () => ({
   hashToken: vi.fn((raw: string) => `hashed:${raw}`),
 }));

src/app/api/auth/passkey/login-verify/__tests__/oidc-only.test.ts

@@ -35,10 +35,6 @@ vi.mock("@/lib/rate-limit", () => ({
   checkAuthSurfaceRateLimit: vi.fn(),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/auth/hmac", () => ({
   hashToken: vi.fn((raw: string) => `hashed:${raw}`),
 }));

src/app/api/auth/passkey/login-verify/__tests__/refusals.test.ts

@@ -31,10 +31,6 @@ vi.mock("@/lib/rate-limit", () => ({
   checkAuthSurfaceRateLimit: vi.fn(),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
-
 vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
 
 vi.mock("next/headers", () => ({

src/app/api/auth/passkey/login-verify/route.ts

@@ -9,7 +9,6 @@ import { recordSignInDevice } from "@/lib/auth/login-alert";
 import { auditLog } from "@/lib/auth/audit";
 import { apiSuccess, apiError, safeJson } from "@/lib/api-response";
 import { prisma } from "@/lib/db";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { checkAuthSurfaceRateLimit } from "@/lib/rate-limit";
 import { NextRequest } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
@@ -71,8 +70,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     });
   }
 
-  await ensureDbCompatibility();
-
   // v1.4.43 — tighter shared bucket on trust-chain misconfig.
   const rl = await checkAuthSurfaceRateLimit(
     request,

src/app/api/auth/password/__tests__/route.test.ts

@@ -63,9 +63,6 @@ vi.mock("@/lib/auth/hibp", () => ({
 }));
 
 vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
 vi.mock("next/headers", () => ({
   headers: vi.fn(async () => ({ get: () => null })),
   cookies: vi.fn(async () => ({

src/app/api/auth/register/__tests__/route.test.ts

@@ -72,9 +72,6 @@ vi.mock("@/lib/tz/resolver", () => ({
   resolveServerDefaultTimezone: vi.fn().mockResolvedValue("Europe/Berlin"),
 }));
 
-vi.mock("@/lib/db-compat", () => ({
-  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
-}));
 vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
 vi.mock("next/headers", () => ({
   headers: vi.fn(async () => ({ get: () => null })),

src/app/api/auth/register/route.ts

@@ -12,7 +12,6 @@ import { auditLog } from "@/lib/auth/audit";
 import { apiSuccess, apiError } from "@/lib/api-response";
 import { parseJsonBody } from "@/lib/api/body";
 import { checkAuthSurfaceRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
-import { ensureDbCompatibility } from "@/lib/db-compat";
 import { NextRequest, NextResponse } from "next/server";
 import { apiHandler } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
@@ -79,8 +78,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
     );
   }
 
-  await ensureDbCompatibility();
-
   const userCount = await prisma.user.count();
 
   // Check if registration is enabled.