fix(db): enforce metadata membership foreign keys

tests/auth/test_rbac_migration.py

@@ -1,6 +1,35 @@
 from pathlib import Path
 
 
+def test_metadata_schema_creates_membership_after_referenced_tables():
+    auth_sql = Path("resources/sql/004_metadata_auth_management.sql").read_text(
+        encoding="utf-8"
+    )
+    project_sql = Path(
+        "resources/sql/005_metadata_project_configuration.sql"
+    ).read_text(encoding="utf-8")
+
+    assert "CREATE TABLE IF NOT EXISTS user_project_membership" not in auth_sql
+    assert project_sql.index("CREATE TABLE IF NOT EXISTS projects") < project_sql.index(
+        "CREATE TABLE IF NOT EXISTS user_project_membership"
+    )
+    assert "user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE" in project_sql
+    assert (
+        "project_id UUID NOT NULL REFERENCES projects(id) ON DELETE CASCADE"
+        in project_sql
+    )
+
+
+def test_metadata_schema_avoids_indexes_duplicated_by_unique_constraints():
+    project_sql = Path(
+        "resources/sql/005_metadata_project_configuration.sql"
+    ).read_text(encoding="utf-8")
+
+    assert "idx_projects_code" not in project_sql
+    assert "idx_user_project_membership_user_id" not in project_sql
+    assert "idx_user_project_membership_project_id" in project_sql
+
+
 def test_rbac_migration_normalizes_legacy_roles():
     sql = Path("resources/sql/006_metadata_rbac_roles.sql").read_text(
         encoding="utf-8"