feat(machine): record where a host can be reached, as the host reports it

The machine table said who owns a host, which team it belongs to and when it
was last seen, and nothing about how to reach it. Anything standing in front of
a host and authenticating browsers on its behalf could therefore authorise a
request perfectly and then have nowhere to send it.

Reported, never assigned. A host holds the secret half of this identity and is
the only thing that can know the public half first, so it rides on the beat it
already sends as itself. Omitting the field leaves the stored value alone --
an agent that does not mention where it is has not moved, and an absent field
must never read as "nowhere", which would take every host shipped before this
field off the map on its next beat.

Nullable, because "has never reported one" is a real state that every host
registered before today is in. Unique, because an endpoint id belongs to one
host: two rows claiming the same one would send a request addressed to one
machine to another machine's agent, which is the one mistake here that the
authorisation in front of it cannot catch.

packages/core/migrations/0013_machine_endpoint_id.sql

@@ -0,0 +1,26 @@
+-- Where a host actually is, so that a request authorised for it has somewhere
+-- to go.
+--
+-- Until now this table said who owns a host, which team it belongs to and when
+-- it was last seen, and nothing at all about how to reach it. A proxy that
+-- authenticates a browser on a host's behalf can therefore authorise a request
+-- perfectly and then have nowhere to send it.
+--
+-- **Reported, never assigned.** A host holds the secret half of this identity
+-- and is the only thing that can know the public half first, so this column
+-- records what a host says about itself on a call it already makes as itself.
+-- Nothing here mints one. ref(d-0010)
+--
+-- Nullable, because "has never reported one" is a real state rather than an
+-- error: every host registered before this column existed is in it, and null
+-- reads as "not reachable yet". A default would read as an address and route
+-- somewhere wrong.
+--
+-- Unique, because an endpoint id belongs to exactly one host. Two rows claiming
+-- the same one would send a request addressed to one machine to another
+-- machine's agent, which is the one mistake this column can make that the
+-- authorisation in front of it cannot catch. Postgres allows many nulls under a
+-- unique index, so the hosts that have never reported are unaffected.
+
+ALTER TABLE "machine" ADD COLUMN "endpoint_id" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "machine_endpoint_id_unique" ON "machine" USING btree ("endpoint_id");

packages/core/migrations/meta/_journal.json

@@ -92,6 +92,13 @@
       "when": 1788691753961,
       "tag": "0012_steam_enrolment_without_a_token",
       "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1788725541386,
+      "tag": "0013_machine_endpoint_id",
+      "breakpoints": true
     }
   ]
 }