## Summary

This PR migrates the Mattrax Cloud API from PostgreSQL to MySQL.

The application schema, Drizzle runtime, Hyperdrive wiring, query rewrites, and migrations are implemented. The branch typechecks, tests, builds, and generates MySQL DDL.

**Important:** this PR currently depends on two local `pnpm` patches to Yielded Auth because its MySQL adapter does not yet expose the composed `AuthPersistence` facade. It has also not been run against a live MySQL/Hyperdrive instance. See `docs/mysql-migration.md` for the full analysis.

## What changed

- **Schema** — `packages/enterprise-core/src/schema.ts` converted from `drizzle-orm/pg-core` to `drizzle-orm/mysql-core`:
  - indexed `text` → bounded `varchar` (MySQL cannot index `TEXT` without a prefix),
  - `jsonb` → `json`, `serial` → `AUTO_INCREMENT`,
  - `timestamp` → `datetime(3)` (avoids the 2038 limit and implicit `ON UPDATE`), with UTC pool timezone,
  - removed the `gen_random_uuid()` default (MySQL rejects non-deterministic defaults; provisioning already supplies the UUID).
- **Runtime** — `drizzle-orm/effect-postgres` → `drizzle-orm/effect-mysql2`; `@effect/sql-pg`/`pg` → `@effect/sql-mysql2`/`mysql2`.
- **Hyperdrive** — `MysqlClient.layer` uses the individual `host`/`port`/`user`/`password`/`database` fields, `poolConfig: { disableEval: true, timezone: "Z" }` and `disablePreparedStatements: true`. No `url`: `@effect/sql-mysql2` ignores `poolConfig` when `url` is set, and Hyperdrive rejects `COM_STMT_PREPARE`.
- **Queries** — `onConflictDoNothing` → `insert().ignore()`, `onConflictDoUpdate` → `onDuplicateKeyUpdate`, `DELETE ... RETURNING` → tenant-scoped `findFirst` + `delete`.
- **Migrations** — Postgres migration replaced with generated MySQL DDL. No data migration.

## Validation

```text
pnpm install                                   pass
pnpm typecheck                                 pass
pnpm test                                      pass (22 files, 185 tests)
pnpm --filter @mattrax/web build               pass
pnpm --filter @mattrax/api build               pass
pnpm --filter @mattrax/api db:generate         pass
```

There was no MySQL server available in the environment, so the DDL and runtime path were **not executed**. Green checks are type/build/codegen only.

## Review focus: no composed MySQL auth adapter

`@yielded/auth-persistence-drizzle@0.1.0-beta.47` exports `/Mysql2` with explicit service factories, but unlike `/Postgres` it does **not** export `AuthPersistence`. `@yielded/auth-persistence`'s composed layer also only recognises `pg`/`sqlite` in its `onDialectOrElse` check. Mattrax's auth composition uses:

```ts
AuthPersistence.make(AuthDefinition).managed(...)
AuthPersistenceConfig.layer / Config / Provisioning
```

which cannot be expressed with the explicit MySQL factories without hand-wiring every table mapping, service and transaction/coordinator owner.

This PR carries two local patches as a proposal for the upstream change:

- `patches/@yielded__auth-persistence@0.1.0-beta.47.patch` — allow `mysql` in the composed layer dialect gate.
- `patches/@yielded__auth-persistence-drizzle@0.1.0-beta.47.patch` — add a MySQL `Backend` for `createPersistence` and export `AuthPersistence` from `/Mysql2`.

These are scaffolding, not a final solution. The remaining upstream concerns are:

- MySQL transaction/isolation ownership matching the explicit MySQL adapter.
- `validateStorageBatch("mysql", ...)` against a real MySQL 8 schema and index limits.
- Key-length design for future OAuth/passkey composite keys.

Full details and estimates are in `docs/mysql-migration.md`.

## Test plan

- [x] `pnpm typecheck`
- [x] `pnpm test`
- [x] `pnpm --filter @mattrax/web build`
- [x] `pnpm --filter @mattrax/api build`
- [x] `pnpm --filter @mattrax/api db:generate`
- [ ] Apply the generated migration to MySQL 8
- [ ] Register, sign in, change password, and exercise session revocation against MySQL
- [ ] Deploy a preview against Hyperdrive MySQL with `disableEval` and text-protocol queries
- [ ] Decide whether to upstream the composed MySQL adapter or keep Postgres