sync: port module changes from constructive-db (identifier claims sweep, billing provider seams, dns_1123 digest)

[pyramation]

Summary

Ports the module drift that accumulated in constructive-db/pgpm-modules/* since the last sync (84ce6026), following the same pattern as previous syncs (original table change files mutated in place, no ALTER changes, bundles regenerated with pgpm package).

metaschema-modules

• user_auth_module (+1 column, after sweep_expired_sessions_function) — constructive-db #3830:

  sweep_unverified_identifiers_function text NOT NULL DEFAULT 'sweep_unverified_identifiers',

• billing_provider_module — operation ledger / provider state / billing health table refs (billing_operations_table_*, billing_provider_state_table_*, billing_health_table_* + FKs, indexes, @module_table comments) and the generated-function name columns (reserve_billing_operation_function … record_billing_health_function). Verify file updated to match.
• FK snapshot constraintCount 567 → 570 (three new FKs).

inflection

• dns_1123 now digest-suffixes values > 63 chars (left(value,50) with trailing - trimmed + - + first 12 hex of sha256(original)) instead of truncating, so long namespaces can't collide. Test vectors ported.

Deliberately not ported

• LICENSE / Makefile / *.control / README.md differences: repo-specific boilerplate that previous syncs never carried over.
• constructive-test → test imports stay pgsql-test here (this repo's convention; upstream renamed its test package).
• upstream's snapshot constraintCount: 565 — stale on their side; the live schema here yields 570, which is what the snapshot now records.
• packages/types/__tests__/upload-ids.test.ts exists only here; kept.
• db-utils / infra-utils exist upstream but not here and were never mirrored; left out (not part of the shared module set).

Verified locally on Postgres 18: pnpm test in both touched modules and pgpm test-packages --full-cycle (deploy → verify → revert) across all modules pass.

Link to Devin session: https://app.devin.ai/sessions/81c4f0c6da0146aaaae029cb31c88ec8
Open in Devin Desktop: https://app.devin.ai/desktop/session/81c4f0c6da0146aaaae029cb31c88ec8?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. 🟡 1 medium

💬 Inline comments (1)

• 🟡 Declare pgcrypto for dns_1123's sha256 — dns_1123.sql:49

---

This PR changes the inflection.dns_1123 procedure to truncate names to a 50-char head plus a 12-hex sha256 suffix, aligns its TypeScript tests and the regenerated pgpm-inflection--0.46.0.sql bundle, and adds table_id/table_name columns and function-wiring columns to the billing_provider_module and user_auth_module tables, mirroring them into the metaschema-modules bundle and snapshot.

Files	Change
inflection/deploy/.../dns_1123.sql + test + bundle	Replaced the dns_1123 normalizer with sha256-based hash truncation and regenerated the bundle + tests to match.
metaschema-modules/.../billing_provider_module/table.sql + verify + bundle + snapshot	Added table-reference columns and indexes to the billing table, wired verify, and regenerated the bundle/snapshot.
metaschema-modules/.../user_auth_module/table.sql + bundle	Added an identifier maintenance-seam function column to the auth table and regenerated the bundle.

_{Reviewed commit: 1c03e17}

[tenki-reviewer]

PR #131 rewrites the SQL inflection.dns_1123 name-normalizer to a hash-truncation scheme and extends the billing/auth module table schemas, with matching generated bundle artifacts and tests.

Key findings

• 🟡 Declare pgcrypto for dns_1123's sha256 — dns_1123.sql:49