fix(authz): guard scopeKey's tenantId type, add deterministic C1/C2 guard

N1: scopeKey guarded the empty-string VALUE but not the TYPE. A
non-string tenantId (null, 0, false, an object) flowed through
un-normalised, and the adapters disagreed about the result - db
rejects null on NOT NULL, memory accepts it as an unreachable row; 0
and false stringify differently and could collide. Now
`typeof tenantId !== "string" || tenantId === ""` is refused with the
same WRN-AUTHZ-SCOPE error. Added a conformance case covering
null/0/false/{}.

N2: nothing failed if grant() were re-wrapped in db.tx, reintroducing
the shared-connection rollback from C1/C2 - timing-based tests can't
reliably prove a transaction is never opened. Added
db-no-transaction.test.ts: a fake Db with a spied driver.transaction
and statement-recording all/exec, driving every PermissionStore method
and asserting zero transaction calls and no "BEGIN" in any recorded
statement. Verified it fails when grant() is temporarily re-wrapped in
db.tx, then restored.

Also documents two things in db.ts as comments only: the UNIQUE
constraints are now load-bearing for ON CONFLICT/ON DUPLICATE KEY
target inference, and MySQL's VALUES(effect) upsert syntax is
deprecated since 8.0.20 (no MySQL server in CI to catch its removal).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/authz/src/db.ts

@@ -7,7 +7,16 @@ import type { AuthzScope, SubjectAssignments } from "./types.ts";
 // database-related, including the DDL the CLI scaffolds.
 export { authzMigrationSql } from "./migrations.ts";
 
-/** Create the tables if absent. Production apps should use a real migration. */
+/**
+ * Create the tables if absent. Production apps should use a real migration.
+ *
+ * The UNIQUE constraints in this DDL are load-bearing beyond deduplication:
+ * `grant`/`assignRole` below use ON CONFLICT / ON DUPLICATE KEY, which infers
+ * its conflict target from them. A hand-rolled migration that recreates these
+ * tables without `_wrn_authz_grant_unique` (or the assignment equivalent)
+ * will make those methods reject outright, where the old delete-then-insert
+ * approach would have silently worked without the constraint.
+ */
 export async function ensureAuthzTables(
   db: Db,
   dialect: Dialect = db.driver.dialect,
@@ -73,6 +82,10 @@ export function dbPermissionStore(db: Db): PermissionStore {
     },
 
     async grant(subjectId, permission, effect, scope) {
+      // `VALUES(effect)` is deprecated as of MySQL 8.0.20 in favour of the
+      // row-alias form (`... VALUES (...) AS new ON DUPLICATE KEY UPDATE
+      // effect = new.effect`). Noted here rather than migrated because there
+      // is no MySQL server in CI to catch its eventual removal.
       await db.exec(
         `INSERT INTO _wrn_authz_grant (subject_id, scope, permission, effect) VALUES (${p(1)}, ${p(2)}, ${p(3)}, ${p(4)})` +
           onConflict(

packages/authz/src/store.ts

@@ -18,16 +18,23 @@ export interface PermissionStore {
 
 /**
  * Global assignments are stored under the empty-string scope key. An OMITTED
- * scope means global; an explicitly EMPTY tenantId is refused, because it is
- * indistinguishable from global and would let a caller who controls the tenant
- * id read and write global assignments.
+ * scope means global; an explicitly EMPTY or non-string tenantId is refused,
+ * because an empty string is indistinguishable from global (and would let a
+ * caller who controls the tenant id read and write global assignments), and a
+ * non-string value (e.g. `null` from a JSON body or a nullable column) would
+ * otherwise flow through un-normalised and leave the adapters disagreeing
+ * about what happened.
  */
 export function scopeKey(scope?: AuthzScope): string {
   const tenantId = scope?.tenantId;
   if (tenantId === undefined) return "";
-  if (tenantId === "") {
+  // Guard the TYPE as well as the value: a null from a JSON body or a nullable
+  // column would otherwise flow through un-normalised and the adapters would
+  // disagree about what happened - the db rejects on NOT NULL, memory accepts
+  // an unreachable row.
+  if (typeof tenantId !== "string" || tenantId === "") {
     throw new Error(
-      "WRN-AUTHZ-SCOPE: tenantId must not be empty; omit the scope for a global assignment.",
+      "WRN-AUTHZ-SCOPE: tenantId must be a non-empty string; omit the scope for a global assignment.",
     );
   }
   return tenantId;