feat(terminal): host wraps the session key per link guest

migrations/053_terminal_session_link_guests.sql

@@ -0,0 +1,8 @@
+-- Who was admitted to an invite_link session, and by which grant: the host may
+-- wrap the session key only for a user whose admitting grant is still live.
+CREATE TABLE terminal_session_link_guests (
+  session_id  UUID NOT NULL REFERENCES terminal_sessions(id) ON DELETE CASCADE,
+  user_id     UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  grant_id    UUID NOT NULL REFERENCES terminal_session_grants(id) ON DELETE CASCADE,
+  PRIMARY KEY (session_id, user_id)
+);

migrations/054_clear_ended_session_keys.sql

@@ -0,0 +1,2 @@
+UPDATE terminal_sessions SET session_key_bytes = NULL
+WHERE ended_at IS NOT NULL AND session_key_bytes IS NOT NULL;

src/routes/session_codes.rs

@@ -37,8 +37,8 @@ pub async fn create_code(
     check_user_budget(&limiter, auth.0, "session_code_mint").await?;
     crate::routes::terminal::require_active_session_host(&pool, session_id, auth.0).await?;
 
-    // Only invite_link sessions serve raw keys through the short-code/grant
-    // path (get_my_session_key, is_authorized_participant); minting for a
+    // Only invite_link sessions admit through the short-code/grant path
+    // (get_my_session_key, is_authorized_participant); minting for a
     // vault or direct session would hand out a grant nothing can redeem it into.
     let visibility: Option<String> =
         sqlx::query_scalar("SELECT visibility FROM terminal_sessions WHERE id = $1")