fix(api): drop the api_keys.role column default

[multipletwigs]

Drops the api_keys.role column default, split out of #2182 because the migration compatibility policy only accepts a breaking migration in a migrations-only PR.

• Merge after refactor(api-keys): single dashboard-only create path with explicit roles #2182, which makes role required on every create path.
• The DB default is already unused: every INSERT INTO api_keys on main and on refactor(api-keys): single dashboard-only create path with explicit roles #2182 names role with a bound value (main fills it in the handlers, routes/api-keys/handlers.ts:254), so a rollback to the previous image still inserts cleanly.
• Marked -- sdp:migration-compat: breaking because the check can't see the app-side value.

Schema before/after (reconstructed from 0001_initial_schema.sql):

before: role | text | not null | default 'api_developer'::text
after:  role | text | not null |

Verification: check:migration-compat passes locally; scanned all 59 INSERT INTO api_keys sites, none omit role. Migration not applied to a live DB; CI DB suites not run locally.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sdp-docs	Ready	Preview	Oct 4, 2026 2:35am UTC
sdp-web	Ready	Preview	Oct 4, 2026 2:35am UTC

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Database migration removes a column default.

The PR appears safe to merge based on the reviewed API-key creation paths.

Summary

Removes the PostgreSQL default from api_keys.role so inserts must supply a role explicitly.

• The reviewed application create paths already provide that value.

_{Reviews (1) · Last reviewed commit: "fix(db): drop the api_keys.role default"}