Platform app move gap: Import an app's customer accounts without reading the secrets #11731

I added section 8 to docs/features/platform-app-move.md. It sets out how a moved app's customer accounts and password hashes come across without the crew reading them. The change is documentation only, so I ran no tests or checks. The procedure itself was not run either, as the old node and its data are outside a crew run's reach.

What the section says

• Hashes: they are carried as stored (bcrypt, argon2, scrypt, pbkdf2), since a hash can't be converted without the password. Any pepper is a secret the owner sets by name.
• Crew work: the crew writes the loader and a verifier that recognises each format by its prefix. It tests them only on made-up accounts, refuses unknown prefixes, and rehashes to the new app's own format at the next sign-in.
• Owner work: the owner exports only the columns the new app needs and runs the load. Sessions, reset tokens and API keys are not exported, so everyone is signed out.
• Reporting: the loader reports counts per format, rows loaded and refused with the reason, and a SHA-256 over the ordered id and hash pairs on both sides. No row content leaves the owner's side.
• Checks and order:

- The rehearsal check is one working sign-in per format by the owner or a test customer. - The final export comes after the freeze from section 7. - The export file is deleted afterwards.

• Still open: nothing stops an export file being pasted somewhere it shouldn't be, and OAuth accounts need the same provider credentials set by name.

In the "What the forge lacks" list I struck #11705 through, the same way #11704 was, saying it is a procedure plus an app-side loader and verifier. The forge holds none of an app's accounts, so I built no forge feature.

I did not write the loader or verifier, since the section describes them for the crew to write in the migrated app's own repository.

Closes #11705

I added section 8 to docs/features/platform-app-move.md. It sets out how a moved app's customer accounts and password hashes come across without the crew reading them. The change is documentation only, so I ran no tests or checks. The procedure itself was not run either, as the old node and its data are outside a crew run's reach.

What the section says

• Hashes: they are carried as stored (bcrypt, argon2, scrypt, pbkdf2), since a hash can't be converted without the password. Any pepper is a secret the owner sets by name.
• Crew work: the crew writes the loader and a verifier that recognises each format by its prefix. It tests them only on made-up accounts, refuses unknown prefixes, and rehashes to the new app's own format at the next sign-in.
• Owner work: the owner exports only the columns the new app needs and runs the load. Sessions, reset tokens and API keys are not exported, so everyone is signed out.
• Reporting: the loader reports counts per format, rows loaded and refused with the reason, and a SHA-256 over the ordered id and hash pairs on both sides. No row content leaves the owner's side.
• Checks and order:

- The rehearsal check is one working sign-in per format by the owner or a test customer. - The final export comes after the freeze from section 7. - The export file is deleted afterwards.

• Still open: nothing stops an export file being pasted somewhere it shouldn't be, and OAuth accounts need the same provider credentials set by name.

In the "What the forge lacks" list I struck #11705 through, the same way #11704 was, saying it is a procedure plus an app-side loader and verifier. The forge holds none of an app's accounts, so I built no forge feature.

I did not write the loader or verifier, since the section describes them for the crew to write in the migrated app's own repository.

I've pushed all three fixes to docs/features/platform-app-move.md on the same branch. It is still docs-only, so I ran no tests or checks.

• Claims about what exists: step 2 now says the crew will write the loader and verifier in the migrated app's own repository, and that they are not yet written. The #11705 line in the lacks list is no longer struck through. It now reads as a procedure with the loader and verifier still to be written, and it names #11697 for how the file would reach a preview.
• Step 3 (running the loader): I removed the preview data directory option. The owner loads the file on their own machine into a copy of the new app's database and hands that database over through the step-3 data copy. The section now says the export file never goes to a preview or a run, because the forge can't receive it unseen until #11697 exists.
• The digest: the SHA-256 is now an HMAC-SHA-256 over the ordered id and hash pairs. It uses a throwaway key the owner makes and keeps, and the section says why it has to be keyed. Counts and digests go in the issue; the key does not.