fix(identity): preserve revoked model offering access

[idunara21]

Summary

Preserve explicit model-offering access revocations across catalog reloads.

Root cause

GET /api/host/model-offerings calls migrateLegacyModelOfferings(). The migration copied matching rows from host_model_entitlement into host_model_offering_entitlement on every invocation, including for offerings that already existed.

If an administrator removed an offering entitlement while a matching legacy wildcard grant remained, the next catalog request recreated the removed entitlement. The UI therefore reported a successful save, but a reload widened access again.

Proposed fix

Copy legacy grants only when the migration creates a new offering. Existing offerings then use their current offering-level entitlements as the source of truth, so later administrator changes are preserved.

This keeps the initial legacy migration behavior while making repeated migration calls genuinely idempotent with respect to explicit revocations.

Regression coverage

The integration test now verifies this sequence:

1. A legacy grant is migrated to a model offering.
2. An administrator replaces that offering's entitlements with an empty list.
3. A subsequent host catalog request reruns the migration.
4. The member can no longer see the offering.

Validation

• pnpm exec vitest run packages/backend/src/identity/roles-model-offerings.integration.test.ts
• pnpm exec vp check packages/backend/src/identity/identity.ts packages/backend/src/identity/roles-model-offerings.integration.test.ts
• pnpm run slop-check
• Production reproduction validated: the offering entitlement stays absent after repeated catalog reloads and a non-admin member cannot see it.