feat(db): schema for ResourceRevision, ResourceProposal, Skill

Phase 1 of the Skills + Revisions + Proposals work. Purely additive — no
existing rows are touched, no tables renamed, no columns dropped.

New tables:
- ResourceRevision — append-only audit + diff log keyed by
  (resourceType, resourceId). Both Prompt and Skill produce revisions on
  every change. Soft FK so revisions outlive the resources they describe.
  Indexed for history viewer (latest-first), semver lookup, and
  cross-resource sync diff via contentHash.
- ResourceProposal — generic propose/approve/reject queue. Drop-in
  replacement for the prompt-only PromptRequest. Created empty here;
  PR-2 will rename PromptRequest → _PromptRequest_legacy and backfill.
- Skill — new resource type that mirrors Prompt for everything CRUD-
  shaped. Adds `files` Json (multi-file bundles, materialised onto disk
  by `mcpctl skills sync` in PR-5) and `metadata` Json (typed app-layer
  in PR-3: hooks, mcpServers, postInstall, …).

New columns on Prompt:
- semver (semver string, default '0.1.0') — auto-bumped patch on save
  by PromptService.update once PR-2 wires it. Distinct from `version`,
  which stays as the optimistic-concurrency counter.
- currentRevisionId — soft pointer to the latest ResourceRevision row.

DB tests cover scope rules (project XOR agent XOR neither), name
uniqueness across both compound keys, cascade-on-delete, soft-FK
survival of deletion, and JSON column persistence.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/db/tests/resource-proposal-schema.test.ts

@@ -0,0 +1,147 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import type { PrismaClient } from '@prisma/client';
+import { setupTestDb, cleanupTestDb, clearAllTables } from './helpers.js';
+
+describe('ResourceProposal schema', () => {
+  let prisma: PrismaClient;
+
+  beforeAll(async () => {
+    prisma = await setupTestDb();
+  }, 30_000);
+
+  afterAll(async () => {
+    await cleanupTestDb();
+  });
+
+  beforeEach(async () => {
+    await clearAllTables(prisma);
+  });
+
+  async function createUser() {
+    return prisma.user.create({
+      data: {
+        email: `test-${Date.now()}-${Math.random()}@example.com`,
+        name: 'Test',
+        passwordHash: '!locked',
+        role: 'USER',
+      },
+    });
+  }
+
+  async function createProject(name = `project-${Date.now()}-${Math.random()}`) {
+    const user = await createUser();
+    return prisma.project.create({ data: { name, ownerId: user.id } });
+  }
+
+  it('creates a pending prompt proposal with defaults', async () => {
+    const project = await createProject();
+    const proposal = await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'prompt',
+        name: 'my-proposal',
+        body: { content: 'hello', priority: 5 },
+        projectId: project.id,
+      },
+    });
+    expect(proposal.id).toBeDefined();
+    expect(proposal.status).toBe('pending');
+    expect(proposal.reviewerNote).toBe('');
+    expect(proposal.approvedRevisionId).toBeNull();
+    expect(proposal.version).toBe(1);
+    expect(proposal.body).toEqual({ content: 'hello', priority: 5 });
+  });
+
+  it('creates a pending skill proposal', async () => {
+    const project = await createProject();
+    const proposal = await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'skill',
+        name: 'my-skill-proposal',
+        body: { content: 'SKILL.md body', metadata: { postInstall: 'hooks/x.sh' } },
+        projectId: project.id,
+      },
+    });
+    expect(proposal.resourceType).toBe('skill');
+  });
+
+  it('enforces unique (resourceType, name, projectId)', async () => {
+    const project = await createProject();
+    await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'prompt',
+        name: 'dup',
+        body: { content: 'a' },
+        projectId: project.id,
+      },
+    });
+    await expect(
+      prisma.resourceProposal.create({
+        data: {
+          resourceType: 'prompt',
+          name: 'dup',
+          body: { content: 'b' },
+          projectId: project.id,
+        },
+      }),
+    ).rejects.toThrow();
+  });
+
+  it('allows same name across different resource types in same project', async () => {
+    const project = await createProject();
+    await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'prompt',
+        name: 'shared',
+        body: { content: 'a' },
+        projectId: project.id,
+      },
+    });
+    const second = await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'skill',
+        name: 'shared',
+        body: { content: 'b' },
+        projectId: project.id,
+      },
+    });
+    expect(second.id).toBeDefined();
+  });
+
+  it('allows status lifecycle: pending → approved', async () => {
+    const project = await createProject();
+    const proposal = await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'prompt',
+        name: 'flow',
+        body: { content: 'hi' },
+        projectId: project.id,
+      },
+    });
+    const approved = await prisma.resourceProposal.update({
+      where: { id: proposal.id },
+      data: {
+        status: 'approved',
+        reviewerNote: 'looks good',
+        approvedRevisionId: 'rev-fake-123',
+      },
+    });
+    expect(approved.status).toBe('approved');
+    expect(approved.reviewerNote).toBe('looks good');
+    expect(approved.approvedRevisionId).toBe('rev-fake-123');
+  });
+
+  it('cascades on project delete', async () => {
+    const project = await createProject();
+    const proposal = await prisma.resourceProposal.create({
+      data: {
+        resourceType: 'prompt',
+        name: 'will-cascade',
+        body: { content: 'hi' },
+        projectId: project.id,
+      },
+    });
+    await prisma.project.delete({ where: { id: project.id } });
+    const found = await prisma.resourceProposal.findUnique({ where: { id: proposal.id } });
+    expect(found).toBeNull();
+  });
+});