feat: secure organization Feishu credentials

hub/prisma/schema.prisma

@@ -42,6 +42,7 @@ model Organization {
   teams                        Team[]
   externalDirectoryConnections ExternalDirectoryConnection[]
   providerConnections          OrganizationProviderConnection[]
+  feishuApplicationConnection  OrganizationFeishuApplicationConnection?
   auditEntries                 AuditEntry[]                    @relation("organizationAudit")
 
   @@index([status])
@@ -109,6 +110,51 @@ model User {
   roleTriggerGrants            RoleTriggerGrant[]            @relation("roleGrantCreator")
   auditEntries                 AuditEntry[]                  @relation("auditActor")
   providerCredentialVersions   ProviderCredentialVersion[]   @relation("providerCredentialVersionCreator")
+  feishuCredentialVersions     FeishuApplicationCredentialVersion[] @relation("feishuCredentialVersionCreator")
+}
+
+/// ADR-0024: exactly one customer-owned Feishu application connection may be
+/// configured for an Organization. External Feishu identifiers are scoped by
+/// this stable connection id, never treated as process-global identities.
+model OrganizationFeishuApplicationConnection {
+  id                     String                       @id @default(cuid())
+  organizationId         String                       @unique
+  appIdentityFingerprint String                       @unique
+  status                 OrganizationConnectionStatus @default(DRAFT)
+  activeSecretVersionId  String?                      @unique
+  activatedAt            DateTime?
+  disabledAt             DateTime?
+  createdAt              DateTime                     @default(now())
+  updatedAt              DateTime                     @updatedAt
+
+  organization        Organization                       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+  secretVersions      FeishuApplicationCredentialVersion[] @relation("feishuCredentialVersions")
+  activeSecretVersion FeishuApplicationCredentialVersion?  @relation("activeFeishuCredentialVersion", fields: [activeSecretVersionId], references: [id], onDelete: Restrict)
+
+  @@index([status])
+}
+
+/// ADR-0024: all Feishu app material, including provider-local app/bot ids, is
+/// inside one immutable authenticated envelope version.
+model FeishuApplicationCredentialVersion {
+  id              String   @id @default(cuid())
+  connectionId    String
+  version         Int
+  envelopeVersion Int      @default(1)
+  keyId           String
+  envelope        Json
+  createdByUserId String?
+  createdAt       DateTime @default(now())
+  retiredAt       DateTime?
+
+  connection OrganizationFeishuApplicationConnection  @relation("feishuCredentialVersions", fields: [connectionId], references: [id], onDelete: Cascade)
+  activeFor  OrganizationFeishuApplicationConnection? @relation("activeFeishuCredentialVersion")
+  createdBy  User?                                   @relation("feishuCredentialVersionCreator", fields: [createdByUserId], references: [id], onDelete: SetNull)
+
+  @@unique([connectionId, version])
+  @@index([connectionId, retiredAt])
+  @@index([keyId])
+  @@index([createdByUserId])
 }
 
 /// ADR-0024: model-provider connection identity is stable and belongs to one