feat: migrate instance_oidc into auth_providers (0005)

server/cmd/main.go

@@ -101,6 +101,13 @@ func runSchemaSetup() {
 		log.Fatalf("failed to ensure auth indexes: %v", err)
 	}
 
+	// 0005 runs AFTER EnsureAuthIndexes: the unique (instance_id, provider_id)
+	// index must exist before anything inserts providers, or a concurrent
+	// re-run could double-insert before the index is there to refuse it.
+	if err := services.MigrateAuthProviders(); err != nil {
+		log.Fatalf("auth provider migration failed: %v", err)
+	}
+
 	if err := services.EnsureSecretIndexes(); err != nil {
 		log.Printf("warning: failed to ensure secret indexes: %v", err)
 	}