feat(coord): DB migration — project-scoped missions, multi-tenant RBAC

Closes #131

- Add userId, phase, milestones, config columns to missions table
- Add new mission_tasks table for coord-managed task tracking
- Both tables enforce per-user RBAC via userId foreign key
- Generate Drizzle migration (0001_magical_rattler.sql)
- Add userId-scoped query methods to brain missions repo
- Add new mission-tasks repo to brain package
- Extend CoordService with DB-backed mission and task CRUD
- Extend CoordController with DB-backed REST endpoints
- Preserve file-based coord endpoints for backwards compatibility

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/gateway/src/coord/coord.dto.ts

@@ -1,3 +1,5 @@
+// ── File-based coord DTOs (legacy file-system backed) ──
+
 export interface CoordMissionStatusDto {
   mission: {
     id: string;
@@ -47,3 +49,42 @@ export interface CoordTaskDetailDto {
     startedAt: string;
   };
 }
+
+// ── DB-backed coord DTOs ──
+
+export interface CreateDbMissionDto {
+  name: string;
+  description?: string;
+  projectId?: string;
+  phase?: string;
+  milestones?: Record<string, unknown>[];
+  config?: Record<string, unknown>;
+  status?: 'planning' | 'active' | 'paused' | 'completed' | 'failed';
+}
+
+export interface UpdateDbMissionDto {
+  name?: string;
+  description?: string;
+  projectId?: string;
+  phase?: string;
+  milestones?: Record<string, unknown>[];
+  config?: Record<string, unknown>;
+  status?: 'planning' | 'active' | 'paused' | 'completed' | 'failed';
+}
+
+export interface CreateMissionTaskDto {
+  missionId: string;
+  taskId?: string;
+  status?: 'not-started' | 'in-progress' | 'blocked' | 'done' | 'cancelled';
+  description?: string;
+  notes?: string;
+  pr?: string;
+}
+
+export interface UpdateMissionTaskDto {
+  taskId?: string;
+  status?: 'not-started' | 'in-progress' | 'blocked' | 'done' | 'cancelled';
+  description?: string;
+  notes?: string;
+  pr?: string;
+}

apps/gateway/src/coord/coord.service.ts

@@ -1,4 +1,6 @@
-import { Injectable, Logger } from '@nestjs/common';
+import { Injectable, Logger, Inject } from '@nestjs/common';
+import type { Brain } from '@mosaic/brain';
+import { BRAIN } from '../brain/brain.tokens.js';
 import {
   loadMission,
   getMissionStatus,
@@ -16,6 +18,8 @@ import path from 'node:path';
 export class CoordService {
   private readonly logger = new Logger(CoordService.name);
 
+  constructor(@Inject(BRAIN) private readonly brain: Brain) {}
+
   async loadMission(projectPath: string): Promise<Mission | null> {
     try {
       return await loadMission(projectPath);
@@ -70,4 +74,68 @@ export class CoordService {
       return [];
     }
   }
+
+  // ── DB-backed methods for multi-tenant mission management ──
+
+  async getMissionsByUser(userId: string) {
+    return this.brain.missions.findAllByUser(userId);
+  }
+
+  async getMissionByIdAndUser(id: string, userId: string) {
+    return this.brain.missions.findByIdAndUser(id, userId);
+  }
+
+  async getMissionsByProjectAndUser(projectId: string, userId: string) {
+    return this.brain.missions.findByProjectAndUser(projectId, userId);
+  }
+
+  async createDbMission(data: Parameters<Brain['missions']['create']>[0]) {
+    return this.brain.missions.create(data);
+  }
+
+  async updateDbMission(
+    id: string,
+    userId: string,
+    data: Parameters<Brain['missions']['update']>[1],
+  ) {
+    const existing = await this.brain.missions.findByIdAndUser(id, userId);
+    if (!existing) return null;
+    return this.brain.missions.update(id, data);
+  }
+
+  async deleteDbMission(id: string, userId: string) {
+    const existing = await this.brain.missions.findByIdAndUser(id, userId);
+    if (!existing) return false;
+    return this.brain.missions.remove(id);
+  }
+
+  // ── DB-backed methods for mission tasks (coord tracking) ──
+
+  async getMissionTasksByMissionAndUser(missionId: string, userId: string) {
+    return this.brain.missionTasks.findByMissionAndUser(missionId, userId);
+  }
+
+  async getMissionTaskByIdAndUser(id: string, userId: string) {
+    return this.brain.missionTasks.findByIdAndUser(id, userId);
+  }
+
+  async createMissionTask(data: Parameters<Brain['missionTasks']['create']>[0]) {
+    return this.brain.missionTasks.create(data);
+  }
+
+  async updateMissionTask(
+    id: string,
+    userId: string,
+    data: Parameters<Brain['missionTasks']['update']>[1],
+  ) {
+    const existing = await this.brain.missionTasks.findByIdAndUser(id, userId);
+    if (!existing) return null;
+    return this.brain.missionTasks.update(id, data);
+  }
+
+  async deleteMissionTask(id: string, userId: string) {
+    const existing = await this.brain.missionTasks.findByIdAndUser(id, userId);
+    if (!existing) return false;
+    return this.brain.missionTasks.remove(id);
+  }
 }