feat(scribe): add the Scribe domain — addresses, send, mailbox, history, find, mark, tag (T-5)

The Office (workspace D-66, D-68, D-73) needs a message bus: an address is
a topic named for an identity, owned by a tenant and a consumer. D-68 puts
it here, in core-api's own database, behind its own auth, following
src/domains/book/.

Migration 006 lands the whole schema by hand (down_revision="005"):
scribe_addresses (owner_tenant + name primary key — no surrogate id, since
no route ever references an address except by name), scribe_messages
(retained; a generated tsvector search column + GIN index on subject/body,
and a GIN index on the topics array for history's lookup), and
scribe_mailbox_entries (one row per recipient address per message, unique
on address+message_id). No data: seeding `jeroen` and `tower-control` is a
deploy step through `register`, not this migration.

Routes, every one behind require_caller("office", "user"), tenant from the
caller (T-4):

- register/list addresses — register is idempotent for the same consumer,
  409 address_taken for another consumer in the tenant; list marks which
  addresses the caller's consumer owns.
- send — `from` is always the caller's own identity, stamped server-side,
  never read from the body; 403 identity_not_owned if that identity is not
  a registered address owned by the caller's consumer; 404 unknown_address
  (naming the missing ones) if any recipient does not exist in the tenant;
  writes one mailbox entry per recipient.
- mailbox / find — the caller's own identity's entries (mailbox: unread
  first; find: full text via websearch_to_tsquery), both requiring the
  identity be owned by the caller's consumer.
- history — the retained messages sent to an address, oldest first;
  reading never consumes or marks, and reads scribe_messages directly
  rather than joining through mailbox entries.
- mark / tag / untag — share one PATCH route; an entry outside the
  caller's tenant, or addressed to an identity the caller isn't reading
  as, answers 404 not_found — indistinguishable from a nonexistent entry.

Every query filters on the caller's tenant (D-73): an address or message
in another tenant answers exactly like one that does not exist, so no id
is ever confirmed across that boundary (test_scribe.py::TestTenantIsolation,
including two tests proving the tenant filter is load-bearing even when
the same address *name* legitimately exists, differently owned, in two
tenants — not just when the caller's own identity is unregistered there).

Messaging only this round: groups, subscriptions, the notification matrix
and delivery are explicitly not built (workspace T-176) — the schema
already carries what `topics`/`tags` need for them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_scribe_migration.py

@@ -0,0 +1,60 @@
+"""
+Tests for Scribe migration 006.
+
+Runs against `core_api_test` only (see conftest.py — skip when
+TEST_DATABASE_URL is unset, hard failure if it resolves to `core_api`).
+Self-contained: starts and ends at head regardless of what ran before it.
+"""
+import pytest
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy.pool import NullPool
+
+from tests.conftest import run_alembic
+
+
+async def _table_exists(url: str, table: str) -> bool:
+    asyncpg_url = url.replace("postgresql://", "postgresql+asyncpg://", 1)
+    engine = create_async_engine(asyncpg_url, poolclass=NullPool)
+    try:
+        async with engine.connect() as conn:
+            result = await conn.execute(
+                text("SELECT to_regclass(:name) IS NOT NULL AS present"),
+                {"name": table},
+            )
+            return bool(result.scalar())
+    finally:
+        await engine.dispose()
+
+
+class TestMigration006RoundTrip:
+    """Migration 006 must upgrade and downgrade cleanly (dossier verification #1)."""
+
+    @pytest.mark.asyncio
+    async def test_upgrade_creates_scribe_tables(self, test_database_url):
+        result = run_alembic(test_database_url, "upgrade", "head")
+        assert result.returncode == 0, result.stderr
+
+        for table in ("scribe_addresses", "scribe_messages", "scribe_mailbox_entries"):
+            assert await _table_exists(test_database_url, table), f"{table} missing after upgrade"
+
+    @pytest.mark.asyncio
+    async def test_downgrade_then_upgrade_round_trips_cleanly(self, test_database_url):
+        baseline = run_alembic(test_database_url, "upgrade", "head")
+        assert baseline.returncode == 0, baseline.stderr
+
+        down = run_alembic(test_database_url, "downgrade", "005")
+        assert down.returncode == 0, down.stderr
+        assert not await _table_exists(test_database_url, "scribe_addresses")
+        assert not await _table_exists(test_database_url, "scribe_messages")
+        assert not await _table_exists(test_database_url, "scribe_mailbox_entries")
+        # Book tables, created by the migration below this one, must survive
+        # a downgrade of 006 — proves 006 only touches its own tables.
+        assert await _table_exists(test_database_url, "book_records")
+
+        # Leave the schema at head for the rest of the suite.
+        up = run_alembic(test_database_url, "upgrade", "006")
+        assert up.returncode == 0, up.stderr
+        assert await _table_exists(test_database_url, "scribe_addresses")
+        assert await _table_exists(test_database_url, "scribe_messages")
+        assert await _table_exists(test_database_url, "scribe_mailbox_entries")