feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

app/models/access.go

@@ -0,0 +1,60 @@
+package models
+
+import (
+	"rsgit.ru/rsmon/rsmon/app/models/concerns"
+)
+
+// Access represents membership of a User (or ApiKey) within a tenant
+// Account, optionally scoped to a Group or Monitor.
+//
+// A User can hold many Access rows across many Accounts — the Access
+// table is the source of truth for "who can see what". Each row answers:
+//
+//	"Does user U have permission P on scope S of account A?"
+//
+// Where:
+//
+//   - A = AccountID           (tenant)
+//   - U = UserID              (or ApiKeyID for service tokens)
+//   - P = Role                ("owner" | "admin" | "manager" | "view" |
+//     "notify")
+//   - S = Kind + (GroupID | MonitorID) — defaults to account-wide when
+//     Kind = "account" and both ids are
+//     nil.
+//
+// One Access row may also reference the Invite that produced it via
+// InviteID. The Invite is preserved after registration so the access
+// history stays auditable — system-registered users and admin-added
+// users have nil InviteID.
+//
+// See docs/plans/users-and-rbac.md for the full RBAC matrix.
+type Access struct {
+	concerns.Model
+	AccountID int64    `gorm:"type:bigint REFERENCES accounts(id)" json:"account_id"`
+	Account   *Account `json:"-"`
+
+	// Kind access kind, account \ group \ monitor
+	Kind string `gorm:"not null;default:'account'" json:"kind"`
+
+	UserID   *int64  `gorm:"type:bigint REFERENCES users(id)" json:"-"`
+	User     *User   `json:"-"`
+	ApiKeyID *int64  `gorm:"type:bigint REFERENCES api_keys(id)" json:"-"` //nolint:revive // accepted lint exception
+	ApiKey   *ApiKey `json:"-"`                                            //nolint:revive // accepted lint exception
+	InviteID *int64  `gorm:"type:bigint REFERENCES invites(id)" json:"-"`
+	Invite   *Invite `json:"-"`
+
+	GroupID   *int64 `gorm:"type:bigint REFERENCES groups(id)" json:"group_id,omitempty"`
+	MonitorID *int64 `gorm:"type:bigint REFERENCES monitors(id)" json:"monitor_id,omitempty"`
+
+	Role string `json:"role"`
+
+	// SeatType is additive to Role: role remains the authorization decision,
+	// while seat type is the billing entitlement.
+	SeatType    string `gorm:"size:16;not null;default:'login'" json:"seat_type"`
+	Status      string `gorm:"size:16;not null;default:'active'" json:"status"`
+	NotifyOnly  bool   `gorm:"not null;default:false" json:"notify_only"`
+	SeatAddonID *int64 `json:"seat_addon_id,omitempty"`
+
+	concerns.Timestamped `json:"-"`
+	Audited
+}