fix(orb): prevent OAuth self-enrollment from re-enabling operator-disabled installs

[JSONbored]

Motivation

• Prevent a privilege/authorization bypass where a verified installation admin could revisit the OAuth callback and clear an operator opt-out by flipping registered back to 1 and obtaining a new enrollment secret.
• Ensure operator-controlled revocation/disable remains authoritative and cannot be undone via the OAuth self-enrollment flow.

Description

• Add a new installation column self_enrollment_disabled (migration 0074_orb_self_enrollment_disabled.sql) to separate operator disables from pending/unregistered installs.
• Read self_enrollment_disabled in the Orb OAuth callback and block self-enrollment when it is set, returning a 403 and an explanatory landing page instead of auto-registering. (src/orb/oauth.ts)
• Update the internal operator POST /v1/internal/orb/installations/register endpoint to set self_enrollment_disabled = 1 when opting out and clear it when opting back in, so operator actions persist as a distinct state. (src/api/routes.ts)
• Add integration regression tests that cover: (a) operator-disable prevents OAuth re-enablement, and (b) the operator register endpoint toggles self_enrollment_disabled correctly while preserving the zero-touch flow for non-disabled pending installs. (test/integration/orb-oauth.test.ts, test/integration/orb-broker.test.ts)

Testing

• Ran the relevant integration suites with npx vitest run test/integration/orb-oauth.test.ts test/integration/orb-broker.test.ts and they passed (2 files, 28 tests, 28 passed).
• Ran migration sanity with npm run db:migrations:check and TypeScript typecheck with npm run typecheck, both succeeded.
• Ran npm run ui:openapi:check, which succeeded on the committed spec check step; npm audit --audit-level=moderate failed due to the npm audit endpoint returning 403 Forbidden from the environment and is thus inconclusive.
• Attempted the full coverage run npm run test:coverage but it failed outside the changed area due to long-running test timeouts and a coverage remapping error (TypeError: jsTokens is not a function), so full repo coverage could not be verified in this environment; the added integration tests exercise the new branches introduced by this change.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.44%. Comparing base (8309b23) to head (d5a9e5c).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1465   +/-   ##
=======================================
  Coverage   95.44%   95.44%           
=======================================
  Files         194      194           
  Lines       21054    21055    +1     
  Branches     7619     7621    +2     
=======================================
+ Hits        20094    20095    +1     
  Misses        383      383           
  Partials      577      577           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.60% <100.00%> (ø)
src/orb/oauth.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.