mig: add session-enrichment capability and discovery-tracking columns to remote_session_issuers

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C555wgLmfbVWf4oxK7FvwB

Author: daviddanialy

.changeset/remote-session-issuer-enrichment-columns.md

@@ -0,0 +1,5 @@
+---
+"server": patch
+---
+
+Add nullable columns to `remote_session_issuers` for the OpenID Connect and OAuth capabilities that drive session enrichment (`userinfo_endpoint`, `introspection_endpoint`, `introspection_endpoint_auth_methods_supported`, `id_token_signing_alg_values_supported`, `claims_supported`, `backchannel_logout_supported`, `authorization_response_iss_parameter_supported`) and for tracking discovery itself (`metadata_fetched_at`, `metadata_last_error`, `metadata_last_error_at`). Schema only; discovery does not populate them yet.

server/database/schema.sql

@@ -2365,6 +2365,20 @@ CREATE TABLE IF NOT EXISTS remote_session_issuers (
   -- client_id, which Gram uses to pre-flight whether outbound CIMD is viable.
   client_id_metadata_document_supported BOOLEAN NOT NULL DEFAULT FALSE,
 
+  -- OpenID Connect Discovery, RFC 7662, RFC 9207, and OpenID Back-Channel
+  -- Logout fields that tell Gram which session-enrichment interfaces an
+  -- issuer offers. All nullable with no default, following
+  -- code_challenge_methods_supported: NULL means discovery has not captured
+  -- the field for this row yet, which stays distinct from an empty array or
+  -- FALSE written by a refresh ("captured; the upstream advertises nothing").
+  userinfo_endpoint TEXT,
+  introspection_endpoint TEXT,
+  introspection_endpoint_auth_methods_supported TEXT[],
+  id_token_signing_alg_values_supported TEXT[],
+  claims_supported TEXT[],
+  backchannel_logout_supported BOOLEAN,
+  authorization_response_iss_parameter_supported BOOLEAN,
+
   oidc BOOLEAN NOT NULL DEFAULT FALSE,
   passthrough BOOLEAN NOT NULL DEFAULT FALSE,
 
@@ -2385,6 +2399,18 @@ CREATE TABLE IF NOT EXISTS remote_session_issuers (
   -- drop the OIDC fields they omit.
   metadata JSONB,
 
+  -- When discovery last wrote the discovered endpoint, capability, and
+  -- metadata columns. updated_at also moves on operator edits, so this is
+  -- the only way to tell a stale capability set from a fresh one and the
+  -- only thing a scheduled refresh can order by. NULL for rows created from
+  -- the form or predating capture.
+  metadata_fetched_at timestamptz,
+  -- The public-safe reason the most recent metadata refresh failed, and when.
+  -- NULL when the row has never failed a refresh; cleared by the next
+  -- successful one.
+  metadata_last_error TEXT,
+  metadata_last_error_at timestamptz,
+
   created_at timestamptz NOT NULL DEFAULT clock_timestamp(),
   updated_at timestamptz NOT NULL DEFAULT clock_timestamp(),
   deleted_at timestamptz,