fix: migration to convert user_id text → uuid with FK to auth.users

[bmersereau]

Summary

• Adds backend/migrations/20260513_userid_text_to_uuid.sql — a transactional migration that converts user_id text columns to uuid and adds REFERENCES auth.users(id) FK constraints on all 9 affected tables
• workflows.user_id uses ON DELETE SET NULL (not CASCADE) to preserve shared workflows when the owner account is deleted
• Provides a pre-flight check query (in comments) to identify any non-UUID values before applying
• Adds rollback script 20260513_userid_text_to_uuid.rollback.sql

Closes #104
Closes #114

Affected tables

projects, project_subfolders, documents, chats, tabular_reviews, tabular_review_chats, workflows, hidden_workflows, workflow_shares

Changes

• backend/migrations/20260513_userid_text_to_uuid.sql — the migration (wrapped in BEGIN/COMMIT)
• backend/migrations/20260513_userid_text_to_uuid.rollback.sql — rollback script
• backend/src/lib/__tests__/useridMigration.test.ts — 5 static analysis tests
• backend/package.json — "test": "vitest run" script added

⚠️ Apply instructions

1. Run the pre-flight check query from the migration comments — confirm zero rows returned
2. Apply via Supabase dashboard SQL editor or psql
3. Verify with \d public.projects that user_id shows type uuid and a FK constraint

Test plan

• Unit tests added and passing (5/5)
• Backend build passes

[bmersereau]

PR Review

Summary

Adds a transactional SQL migration converting user_id text to uuid references auth.users(id) across 9 tables, plus a rollback script. Five static-analysis tests verify the migration is transactional, covers all tables, uses a USING cast, adds FK constraints with ON DELETE CASCADE/SET NULL, and that the rollback script exists.

Findings

• [severity:praise] Migration is wrapped in BEGIN/COMMIT — safe to abort on error
• [severity:praise] workflows.user_id uses ON DELETE SET NULL (not CASCADE) — correct decision to preserve shared workflows after owner deletion
• [severity:praise] Pre-flight check query included in comments — operator has guidance before applying
• [severity:praise] Rollback script present and comprehensive
• [severity:minor] The rollback script drops FK constraints and reverts to text — but it does not restore any previously-existing FK constraint if one existed. Given user_id was plain text before, this is correct; just worth noting in operator runbook
• [severity:nit] Migration has no explicit SET search_path = public guard. On multi-schema setups, public. table qualifiers (which are present) are sufficient — no change needed

Specific checks

• "test": "vitest run" in package.json ✓
• vitest.config.ts include filter present ✓
• Rollback script exists ✓
• BEGIN/COMMIT present ✓
• Tests pass: 7/7 ✓

Verdict

Approve — ship it after pre-flight check confirms no non-UUID rows.