feat(consent): record consent in the same transaction as the user

The invariant this establishes: a user row without a consent record is
impossible. ResolveAll runs before the transaction opens, so an incomplete
payload never starts one; inside it, the user insert and the consent insert
both land or neither does.

user.Repository and the new user_consents repository each gain a Create that
takes a *sqlx.Tx. pkg/db has WithTxn but carries no transaction on the
context, so the transaction is threaded through explicitly rather than found
on one. Both are additive, and the user repository change is the one place
this feature reaches outside its own domain. The consent repository has
Create and nothing else, because the table is immutable.

consent.Grant writes one record for the documents it is given and has no
completeness rule of its own. ResolveAll is what decides a signup covers
every configured document, and keeping that out of Grant leaves room for a
later re-consent covering a subset without a second write path.

getOrCreateUser now has three outcomes for a new user. A complete payload
writes both rows in one transaction. An incomplete one returns
ErrConsentRequired and writes nothing. An existing user gets no record at
all, which is absolute: a record written outside a user creation would carry
that moment's timestamp and IP for an agreement made elsewhere, which is
worse than no record because it reads like evidence. A nil flow means one of
the paths that create a user without one, and those stay exempt because no
account holder is present to consent.

The completeness check runs at user creation under every intent, not for the
error but as the invariant guarding the write. An unset intent is permissive
for the login gate but never for consent. With app.consent disabled ResolveAll
resolves nothing, and an empty document set means write no record, so nothing
changes for a deployment that does not ask for consent.

Each signup also writes one audit record, with UserConsentGrantedEvent and
ConsentType added to pkg/auditrecord following the entity.verb naming already
there. It goes through the repository with the actor filled in, as userpat
does for its PAT events: the repository enriches an empty actor from the
context, and these endpoints are on the authentication skip list with no
actor in it, so the record would otherwise land as the system actor for an
act a person performed. It is written after the commit, since the audit
repository has no transactional create, so it cannot be atomic with the
record it describes. That is why the consent record is the source of truth
and this one is a breadcrumb: a failure is logged and the signup stands. Its
target metadata carries the whole document snapshot rather than the id and
the version alone, so a reader working from the audit trail can say what was
accepted without reading back a record they may not have access to.

The rollback is tested against a real Postgres rather than a mocked
transaction, since a mock can only pretend to roll back.

See docs/rfcs/0002-explicit-consent-at-signup.md, Enforcement and Storage.

Author: rohanchkrabrty

cmd/serve.go

@@ -349,8 +349,6 @@ func buildAPIDependencies(
 	if err := cfg.App.Consent.Validate(); err != nil {
 		return api.Deps{}, err
 	}
-	consentService := consent.NewService(cfg.App.Consent)
-	logConsentDocuments(logger, consentService.Documents())
 
 	var tokenKeySet jwk.Set
 	if len(cfg.App.Authentication.Token.RSAPath) > 0 {
@@ -399,6 +397,10 @@ func buildAPIDependencies(
 
 	auditRecordRepository := postgres.NewAuditRecordRepository(dbc)
 
+	consentService := consent.NewService(logger, cfg.App.Consent,
+		postgres.NewUserConsentRepository(dbc), auditRecordRepository)
+	logConsentDocuments(logger, consentService.Documents())
+
 	roleRepository := postgres.NewRoleRepository(dbc)
 	policyPGRepository := postgres.NewPolicyRepository(dbc)
 	userRepository := postgres.NewUserRepository(dbc)
@@ -450,7 +452,8 @@ func buildAPIDependencies(
 	userService := user.NewService(userRepository, relationService, sessionService, auditRecordRepository)
 	patValidator := userpat.NewValidator(logger, userPATRepo, cfg.App.PAT)
 	authnService := authenticate.NewService(logger, cfg.App.Authentication,
-		postgres.NewFlowRepository(logger, dbc), mailDialer, tokenService, sessionService, userService, serviceUserService, webAuthConfig, patValidator)
+		postgres.NewFlowRepository(logger, dbc), mailDialer, tokenService, sessionService, userService, serviceUserService, webAuthConfig, patValidator,
+		consentService, dbc)
 	groupService := group.NewService(groupRepository, relationService, authnService, policyService)
 	organizationService := organization.NewService(organizationRepository, relationService, userService,
 		authnService, policyService, preferenceService, roleService)