feat(builtin-models): add managed_by column to models table

Introduce a `managed_by` varchar column on `models` so future declarative
loaders can claim ownership of a subset of rows without disturbing entries
created via the UI/API or seeded by hand-written SQL.

- versioned/000052_models_managed_by.{up,down}.sql add the column with a
  default of '' and a partial index on non-empty values to keep startup
  reconciliation cheap.
- sqlite/000000_init.up.sql is updated in place (the Lite init migration
  is a single file per project convention) so fresh SQLite databases get
  the column from the start.
- Model.ManagedBy mirrors the column. Existing rows default to '' which
  the YAML loader treats as "manually managed, never touch".

Schema half of the YAML-driven built-in-model lifecycle work that follows
up on #1453; the reconciler that uses the column lands in the next commit.

internal/types/model.go

@@ -105,6 +105,14 @@ type Model struct {
 	IsDefault bool `yaml:"is_default"  json:"is_default"`
 	// Whether the model is a builtin model (visible to all tenants)
 	IsBuiltin bool `yaml:"is_builtin"  json:"is_builtin"  gorm:"default:false"`
+	// ManagedBy identifies which subsystem owns this row's lifecycle.
+	// Empty / "" = manually created (UI / API / hand-written SQL); the YAML
+	// builtin-models loader leaves these untouched.
+	// "yaml" = declared in config/builtin_models.yaml; on every startup the
+	// loader UPSERTs the YAML set and soft-deletes YAML-managed rows whose
+	// id is no longer present in the file. Future origins (e.g. "helm",
+	// "operator") can claim their own slice without interfering.
+	ManagedBy string `yaml:"managed_by"  json:"managed_by,omitempty"  gorm:"type:varchar(32);default:''"`
 	// Model status, default: active, possible: downloading, download_failed
 	Status ModelStatus `yaml:"status"      json:"status"`
 	// Creation time of the model

migrations/sqlite/000000_init.up.sql

@@ -37,6 +37,7 @@ CREATE TABLE IF NOT EXISTS models (
     parameters TEXT NOT NULL,
     is_default BOOLEAN NOT NULL DEFAULT 0,
     is_builtin BOOLEAN NOT NULL DEFAULT 0,
+    managed_by VARCHAR(32) NOT NULL DEFAULT '',
     status VARCHAR(50) NOT NULL DEFAULT 'active',
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
@@ -46,6 +47,7 @@ CREATE TABLE IF NOT EXISTS models (
 CREATE INDEX IF NOT EXISTS idx_models_type ON models(type);
 CREATE INDEX IF NOT EXISTS idx_models_source ON models(source);
 CREATE INDEX IF NOT EXISTS idx_models_is_builtin ON models(is_builtin);
+CREATE INDEX IF NOT EXISTS idx_models_managed_by ON models(managed_by);
 
 CREATE TABLE IF NOT EXISTS knowledge_bases (
     id VARCHAR(36) PRIMARY KEY,

migrations/versioned/000052_models_managed_by.down.sql

@@ -0,0 +1,5 @@
+-- Down migration for 000052_models_managed_by.
+
+DROP INDEX IF EXISTS idx_models_managed_by_yaml;
+
+ALTER TABLE models DROP COLUMN IF EXISTS managed_by;

migrations/versioned/000052_models_managed_by.up.sql

@@ -0,0 +1,37 @@
+-- Migration: 000052_models_managed_by
+-- Add a `managed_by` column to `models` so the YAML built-in models loader can
+-- own a slice of the table without disturbing rows created via the UI/API or
+-- seeded by hand-written SQL.
+--
+-- Background:
+--   * 000051-era PR #1453 introduced config/builtin_models.yaml as a
+--     declarative source of truth for built-in models. The first version
+--     could add/update rows but had no way to remove them: deleting an entry
+--     from YAML left the corresponding row in `models`, breaking the
+--     "declarative" contract and forcing operators back into ad-hoc SQL.
+--   * Indiscriminately deleting `is_builtin=true` rows on each startup is
+--     unsafe because some deployments seed built-ins via direct SQL, and
+--     those rows must not be touched.
+--
+-- Solution:
+--   * Add `managed_by` (varchar(32), default ''). YAML loader writes "yaml";
+--     anything else (UI / API / SQL seed) keeps the empty default.
+--   * On every startup the loader UPSERTs YAML entries with managed_by='yaml'
+--     and soft-deletes rows where (is_builtin=true AND managed_by='yaml' AND
+--     id NOT IN <current YAML id set>). Manual rows are never inspected.
+--
+-- This migration is idempotent (IF NOT EXISTS) and safe to re-run.
+
+DO $$ BEGIN RAISE NOTICE '[Migration 000052] Adding models.managed_by column'; END $$;
+
+ALTER TABLE models
+    ADD COLUMN IF NOT EXISTS managed_by VARCHAR(32) NOT NULL DEFAULT '';
+
+-- A partial index on the YAML-managed slice keeps the startup sweep cheap
+-- even if the table grows large. Manual rows (managed_by='') are excluded
+-- so the index stays small.
+CREATE INDEX IF NOT EXISTS idx_models_managed_by_yaml
+    ON models (managed_by)
+    WHERE managed_by <> '';
+
+DO $$ BEGIN RAISE NOTICE '[Migration 000052] Done'; END $$;