feat: database indexes for permission tables

Add indexes to support permission-filtered queries at scale (TASK-486).

- idx_mca_collection: reverse lookup on member_collection_access for
  cascade cleanup when collections are deleted
- idx_collections_system: partial index on (workspace_id, is_system)
  for fast system collection lookups in VisibleCollectionIDs
- idx_wm_user: index on workspace_members(user_id) for user deletion
  cascade and cross-workspace membership queries

internal/store/migrations/032_permission_indexes.sql

@@ -0,0 +1,10 @@
+-- Indexes for permission table query performance (TASK-486).
+
+-- member_collection_access: reverse lookup by collection (for cascade cleanup on collection delete)
+CREATE INDEX IF NOT EXISTS idx_mca_collection ON member_collection_access(collection_id);
+
+-- collections: fast lookup of system collections per workspace
+CREATE INDEX IF NOT EXISTS idx_collections_system ON collections(workspace_id, is_system) WHERE is_system = 1 AND deleted_at IS NULL;
+
+-- workspace_members: fast lookup by user across workspaces (for user deletion cascade)
+CREATE INDEX IF NOT EXISTS idx_wm_user ON workspace_members(user_id);

internal/store/pgmigrations/012_permission_indexes.sql

@@ -0,0 +1,5 @@
+-- Indexes for permission table query performance (TASK-486).
+
+CREATE INDEX IF NOT EXISTS idx_mca_collection ON member_collection_access(collection_id);
+CREATE INDEX IF NOT EXISTS idx_collections_system ON collections(workspace_id, is_system) WHERE is_system = TRUE AND deleted_at IS NULL;
+CREATE INDEX IF NOT EXISTS idx_wm_user ON workspace_members(user_id);

internal/store/store.go

@@ -156,6 +156,7 @@ func (s *Store) migrate() error {
 		"029_username.sql",
 		"030_workspace_owner.sql",
 		"031_collection_access.sql",
+		"032_permission_indexes.sql",
 	}
 
 	for _, name := range migrations {
@@ -211,6 +212,7 @@ func (s *Store) migratePostgres() error {
 		"009_username.sql",
 		"010_workspace_owner.sql",
 		"011_collection_access.sql",
+		"012_permission_indexes.sql",
 	}
 
 	for _, name := range migrations {