Split databases and Redis — prepare infrastructure for per-domain isolation

Redis: per-app DB index (0-5) with shared auth DB 15 for SSO keys;
flushdb replaces flushall so deploys don't wipe cross-app auth state.

Postgres: drop 13 cross-domain FK constraints (migration v2t0p8q9r0),
remove dead ORM relationships, add explicit joins for 4 live ones.
Multi-engine sessions (account + federation) ready for per-domain DBs
via DATABASE_URL_ACCOUNT / DATABASE_URL_FEDERATION env vars.

All URLs initially point to the same appdb — zero behaviour change
until split-databases.sh is run to migrate data to per-domain DBs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

account/bp/auth/routes.py

@@ -364,15 +364,14 @@ def register(url_prefix="/auth"):
 
         # Signal login for this device so client apps can detect it
         try:
-            from shared.browser.app.redis_cacher import get_redis
+            from shared.infrastructure.auth_redis import get_auth_redis
             import time as _time
-            _redis = get_redis()
-            if _redis:
-                await _redis.set(
-                    f"did_auth:{g.device_id}",
-                    str(_time.time()).encode(),
-                    ex=30 * 24 * 3600,
-                )
+            _auth_r = await get_auth_redis()
+            await _auth_r.set(
+                f"did_auth:{g.device_id}",
+                str(_time.time()).encode(),
+                ex=30 * 24 * 3600,
+            )
         except Exception:
             current_app.logger.exception("[auth] failed to set did_auth in Redis")
 
@@ -398,10 +397,9 @@ def register(url_prefix="/auth"):
 
         # Clear login signal for this device
         try:
-            from shared.browser.app.redis_cacher import get_redis
-            _redis = get_redis()
-            if _redis:
-                await _redis.delete(f"did_auth:{g.device_id}")
+            from shared.infrastructure.auth_redis import get_auth_redis
+            _auth_r = await get_auth_redis()
+            await _auth_r.delete(f"did_auth:{g.device_id}")
         except Exception:
             pass
 
@@ -446,10 +444,9 @@ def register(url_prefix="/auth"):
 
         # Clear login signal for this device
         try:
-            from shared.browser.app.redis_cacher import get_redis
-            _redis = get_redis()
-            if _redis:
-                await _redis.delete(f"did_auth:{g.device_id}")
+            from shared.infrastructure.auth_redis import get_auth_redis
+            _auth_r = await get_auth_redis()
+            await _auth_r.delete(f"did_auth:{g.device_id}")
         except Exception:
             pass
 

account/entrypoint.sh

@@ -16,7 +16,7 @@ if [[ -n "${REDIS_URL:-}" && "${REDIS_URL}" != "no" ]]; then
   python3 -c "
 import redis, os
 r = redis.from_url(os.environ['REDIS_URL'])
-r.flushall()
+r.flushdb()
 print('Redis cache cleared.')
 " || echo "Redis flush failed (non-fatal), continuing..."
 fi