chore(v1.1.8): re-bless schema snapshot (reviewer)

`tests/expected_schema.txt` reflecting the v1.1.8 migrations:
- 6 new tables (app_users, app_user_sessions, app_user_email_verifications,
  app_user_password_resets, app_user_invitations, app_user_roles)
- realtime_signing_key column dropped from app_secrets (F1)
- topics_auth_mode_check widened to include 'session' (F3)
- Migrations 0026..0033 added to _sqlx_migrations

Diff verified to have zero unrelated drift.

Reviewer-supplied per REVIEW.md §7; the agent's host couldn't
run BLESS=1 cleanly (no Postgres available during the dispatch).

crates/manager-core/tests/expected_schema.txt

@@ -60,7 +60,6 @@ table: app_members
 
 table: app_secrets
   app_id: uuid NOT NULL
-  realtime_signing_key: bytea NULL
   created_at: timestamp with time zone NOT NULL default=now()
   updated_at: timestamp with time zone NOT NULL default=now()
   realtime_signing_key_encrypted: bytea NULL
@@ -71,6 +70,60 @@ table: app_slug_history
   current_app_id: uuid NOT NULL
   retired_at: timestamp with time zone NOT NULL default=now()
 
+table: app_user_email_verifications
+  token_hash: text NOT NULL
+  app_id: uuid NOT NULL
+  user_id: uuid NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+  expires_at: timestamp with time zone NOT NULL
+  consumed_at: timestamp with time zone NULL
+
+table: app_user_invitations
+  id: uuid NOT NULL default=gen_random_uuid()
+  token_hash: text NOT NULL
+  app_id: uuid NOT NULL
+  email: text NOT NULL
+  display_name: text NULL
+  roles: ARRAY NOT NULL default='{}'::text[]
+  created_at: timestamp with time zone NOT NULL default=now()
+  expires_at: timestamp with time zone NOT NULL
+  accepted_at: timestamp with time zone NULL
+
+table: app_user_password_resets
+  token_hash: text NOT NULL
+  app_id: uuid NOT NULL
+  user_id: uuid NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+  expires_at: timestamp with time zone NOT NULL
+  consumed_at: timestamp with time zone NULL
+
+table: app_user_roles
+  app_id: uuid NOT NULL
+  user_id: uuid NOT NULL
+  role: text NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+
+table: app_user_sessions
+  token_hash: text NOT NULL
+  app_id: uuid NOT NULL
+  user_id: uuid NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+  last_used_at: timestamp with time zone NOT NULL default=now()
+  expires_at: timestamp with time zone NOT NULL
+  absolute_expires_at: timestamp with time zone NOT NULL
+  revoked_at: timestamp with time zone NULL
+
+table: app_users
+  id: uuid NOT NULL default=gen_random_uuid()
+  app_id: uuid NOT NULL
+  email: text NOT NULL
+  password_hash: text NOT NULL
+  display_name: text NULL
+  email_verified_at: timestamp with time zone NULL
+  last_login_at: timestamp with time zone NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+  updated_at: timestamp with time zone NOT NULL default=now()
+
 table: apps
   id: uuid NOT NULL default=gen_random_uuid()
   slug: text NOT NULL
@@ -291,6 +344,33 @@ indexes on app_secrets:
 indexes on app_slug_history:
   app_slug_history_pkey: public.app_slug_history USING btree (slug)
 
+indexes on app_user_email_verifications:
+  app_user_email_verifications_pkey: public.app_user_email_verifications USING btree (token_hash)
+  idx_app_user_email_verifications_user: public.app_user_email_verifications USING btree (app_id, user_id)
+
+indexes on app_user_invitations:
+  app_user_invitations_pkey: public.app_user_invitations USING btree (id)
+  app_user_invitations_token_hash_key: public.app_user_invitations USING btree (token_hash)
+  idx_app_user_invitations_app_pending: public.app_user_invitations USING btree (app_id) WHERE (accepted_at IS NULL)
+
+indexes on app_user_password_resets:
+  app_user_password_resets_pkey: public.app_user_password_resets USING btree (token_hash)
+  idx_app_user_password_resets_user: public.app_user_password_resets USING btree (app_id, user_id)
+
+indexes on app_user_roles:
+  app_user_roles_pkey: public.app_user_roles USING btree (app_id, user_id, role)
+  idx_app_user_roles_user: public.app_user_roles USING btree (app_id, user_id)
+
+indexes on app_user_sessions:
+  app_user_sessions_pkey: public.app_user_sessions USING btree (token_hash)
+  idx_app_user_sessions_expiry: public.app_user_sessions USING btree (expires_at) WHERE (revoked_at IS NULL)
+  idx_app_user_sessions_user: public.app_user_sessions USING btree (app_id, user_id)
+
+indexes on app_users:
+  app_users_pkey: public.app_users USING btree (id)
+  idx_app_users_app: public.app_users USING btree (app_id)
+  idx_app_users_app_email_lower: public.app_users USING btree (app_id, lower(email))
+
 indexes on apps:
   apps_pkey: public.apps USING btree (id)
   apps_slug_key: public.apps USING btree (slug)
@@ -416,6 +496,35 @@ constraints on app_slug_history:
   [FOREIGN KEY] app_slug_history_current_app_id_fkey: FOREIGN KEY (current_app_id) REFERENCES apps(id) ON DELETE CASCADE
   [PRIMARY KEY] app_slug_history_pkey: PRIMARY KEY (slug)
 
+constraints on app_user_email_verifications:
+  [FOREIGN KEY] app_user_email_verifications_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [FOREIGN KEY] app_user_email_verifications_user_id_fkey: FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE
+  [PRIMARY KEY] app_user_email_verifications_pkey: PRIMARY KEY (token_hash)
+
+constraints on app_user_invitations:
+  [FOREIGN KEY] app_user_invitations_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [PRIMARY KEY] app_user_invitations_pkey: PRIMARY KEY (id)
+  [UNIQUE] app_user_invitations_token_hash_key: UNIQUE (token_hash)
+
+constraints on app_user_password_resets:
+  [FOREIGN KEY] app_user_password_resets_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [FOREIGN KEY] app_user_password_resets_user_id_fkey: FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE
+  [PRIMARY KEY] app_user_password_resets_pkey: PRIMARY KEY (token_hash)
+
+constraints on app_user_roles:
+  [FOREIGN KEY] app_user_roles_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [FOREIGN KEY] app_user_roles_user_id_fkey: FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE
+  [PRIMARY KEY] app_user_roles_pkey: PRIMARY KEY (app_id, user_id, role)
+
+constraints on app_user_sessions:
+  [FOREIGN KEY] app_user_sessions_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [FOREIGN KEY] app_user_sessions_user_id_fkey: FOREIGN KEY (user_id) REFERENCES app_users(id) ON DELETE CASCADE
+  [PRIMARY KEY] app_user_sessions_pkey: PRIMARY KEY (token_hash)
+
+constraints on app_users:
+  [FOREIGN KEY] app_users_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [PRIMARY KEY] app_users_pkey: PRIMARY KEY (id)
+
 constraints on apps:
   [PRIMARY KEY] apps_pkey: PRIMARY KEY (id)
   [UNIQUE] apps_slug_key: UNIQUE (slug)
@@ -503,7 +612,7 @@ constraints on secrets:
   [PRIMARY KEY] secrets_pkey: PRIMARY KEY (app_id, name)
 
 constraints on topics:
-  [CHECK] topics_auth_mode_check: CHECK ((auth_mode = ANY (ARRAY['public'::text, 'token'::text])))
+  [CHECK] topics_auth_mode_check: CHECK ((auth_mode = ANY (ARRAY['public'::text, 'token'::text, 'session'::text])))
   [FOREIGN KEY] topics_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
   [PRIMARY KEY] topics_pkey: PRIMARY KEY (app_id, name)
 
@@ -542,3 +651,11 @@ constraints on triggers:
   0023: secrets
   0024: email triggers
   0025: encrypt realtime keys
+  0026: app users
+  0027: app user sessions
+  0028: app user email verifications
+  0029: app user password resets
+  0030: app user invitations
+  0031: app user roles
+  0032: drop plaintext realtime signing key
+  0033: topics auth mode session