chore: align sqlite control plane architecture

- replace default Convex control-plane wording with Rust SQLite control-plane across architecture, AGENTS, Reasonix, and design docs

- retire root Convex functions source and deploy script into recycle while keeping explicit cloud/compat/sync-replica boundaries

- add control-plane migration guard/docs and keep CodeGraph refreshed after the SQLite control-plane cutover

rust/crates/control-plane/src/store.rs

@@ -0,0 +1,172 @@
+//! 控制面 store trait。
+
+use crate::error::ControlPlaneError;
+use crate::model::{
+    AiPolicyRecord, AiRuntimeEventRecord, AiRuntimeRunRecord, AppendAiRuntimeEventInput,
+    AppendAuditInput, AuditLogRecord, AuthSessionRecord, AuthenticatePasswordInput,
+    CreatePasswordIdentityInput, CreateSessionInput, CreateShareLinkInput, CreatedShareLink,
+    DirectoryGrantInput, DirectoryGrantLookup, DirectoryGrantRecord, OutboxEventInput,
+    OutboxEventRecord, ResolvedAccess, ResolvedAuthSession, ShareLinkRecord, SyncStateRecord,
+    UpsertAiPolicyInput, UpsertAiRuntimeRunInput, UpsertSyncStateInput, UpsertUserInput,
+    UserRecord, WorkspaceRecord,
+};
+
+pub trait ControlPlaneStore: Send + Sync {
+    fn upsert_user(&self, input: UpsertUserInput) -> Result<UserRecord, ControlPlaneError>;
+
+    fn create_password_identity(
+        &self,
+        input: CreatePasswordIdentityInput,
+    ) -> Result<(), ControlPlaneError>;
+
+    fn authenticate_password(
+        &self,
+        input: AuthenticatePasswordInput,
+    ) -> Result<ResolvedAuthSession, ControlPlaneError>;
+
+    fn create_session(
+        &self,
+        input: CreateSessionInput,
+    ) -> Result<AuthSessionRecord, ControlPlaneError>;
+
+    fn get_session_by_token_hash(
+        &self,
+        token_hash: &str,
+    ) -> Result<Option<ResolvedAuthSession>, ControlPlaneError>;
+
+    fn revoke_session(&self, session_id: &str) -> Result<(), ControlPlaneError>;
+
+    fn ensure_default_workspace(
+        &self,
+        actor_id: &str,
+    ) -> Result<WorkspaceRecord, ControlPlaneError>;
+
+    fn grant_directory_access(
+        &self,
+        input: DirectoryGrantInput,
+    ) -> Result<DirectoryGrantRecord, ControlPlaneError>;
+
+    fn list_directory_grants(&self) -> Result<Vec<DirectoryGrantRecord>, ControlPlaneError>;
+
+    fn list_directory_grants_for_actor(
+        &self,
+        actor_id: &str,
+    ) -> Result<Vec<DirectoryGrantRecord>, ControlPlaneError>;
+
+    fn find_directory_grants(
+        &self,
+        lookup: DirectoryGrantLookup,
+    ) -> Result<Vec<DirectoryGrantRecord>, ControlPlaneError>;
+
+    fn revoke_directory_grant(
+        &self,
+        grant_id: &str,
+        expected_revision: Option<i64>,
+    ) -> Result<(), ControlPlaneError>;
+
+    fn resolve_access(
+        &self,
+        actor_id: &str,
+        root_uri: &str,
+    ) -> Result<ResolvedAccess, ControlPlaneError>;
+
+    fn create_share_link(
+        &self,
+        input: CreateShareLinkInput,
+    ) -> Result<CreatedShareLink, ControlPlaneError>;
+
+    fn list_share_links(
+        &self,
+        workspace_id: &str,
+    ) -> Result<Vec<ShareLinkRecord>, ControlPlaneError>;
+
+    fn resolve_share_link(
+        &self,
+        token_hash: &str,
+    ) -> Result<Option<ShareLinkRecord>, ControlPlaneError>;
+
+    fn revoke_share_link(&self, link_id: &str) -> Result<(), ControlPlaneError>;
+
+    fn append_audit(&self, input: AppendAuditInput) -> Result<(), ControlPlaneError>;
+
+    fn list_audit_log(&self, limit: usize) -> Result<Vec<AuditLogRecord>, ControlPlaneError>;
+
+    fn append_outbox(
+        &self,
+        input: OutboxEventInput,
+    ) -> Result<OutboxEventRecord, ControlPlaneError>;
+
+    fn drain_outbox(&self, limit: usize) -> Result<Vec<OutboxEventRecord>, ControlPlaneError>;
+
+    fn mark_outbox_delivered(&self, event_id: &str) -> Result<(), ControlPlaneError>;
+
+    fn upsert_ai_policy(
+        &self,
+        input: UpsertAiPolicyInput,
+    ) -> Result<AiPolicyRecord, ControlPlaneError>;
+
+    fn get_ai_policy(
+        &self,
+        actor_id: &str,
+        workspace_id: Option<&str>,
+    ) -> Result<Option<AiPolicyRecord>, ControlPlaneError>;
+
+    fn upsert_sync_state(
+        &self,
+        input: UpsertSyncStateInput,
+    ) -> Result<SyncStateRecord, ControlPlaneError>;
+
+    fn get_sync_state(
+        &self,
+        workspace_id: &str,
+        remote_kind: &str,
+    ) -> Result<Option<SyncStateRecord>, ControlPlaneError>;
+
+    fn upsert_ai_runtime_run(
+        &self,
+        input: UpsertAiRuntimeRunInput,
+    ) -> Result<AiRuntimeRunRecord, ControlPlaneError>;
+
+    fn list_ai_runtime_runs(
+        &self,
+        user_id: &str,
+        workspace_id: Option<&str>,
+        document_id: Option<&str>,
+        session_id: Option<&str>,
+        limit: usize,
+    ) -> Result<Vec<AiRuntimeRunRecord>, ControlPlaneError>;
+
+    fn append_ai_runtime_event(
+        &self,
+        input: AppendAiRuntimeEventInput,
+    ) -> Result<AiRuntimeEventRecord, ControlPlaneError>;
+
+    fn list_ai_runtime_events(
+        &self,
+        user_id: &str,
+        run_id: &str,
+        limit: usize,
+    ) -> Result<Vec<AiRuntimeEventRecord>, ControlPlaneError>;
+
+    fn rename_ai_runtime_session(
+        &self,
+        user_id: &str,
+        session_id: &str,
+        workspace_id: Option<&str>,
+        title: &str,
+    ) -> Result<Vec<AiRuntimeRunRecord>, ControlPlaneError>;
+
+    fn auto_title_ai_runtime_session(
+        &self,
+        user_id: &str,
+        session_id: &str,
+        workspace_id: Option<&str>,
+    ) -> Result<Option<AiRuntimeRunRecord>, ControlPlaneError>;
+
+    fn delete_ai_runtime_session(
+        &self,
+        user_id: &str,
+        session_id: &str,
+        workspace_id: Option<&str>,
+    ) -> Result<usize, ControlPlaneError>;
+}