Wire the id-preserving mappers into a runnable, idempotent, reversible migration:
- backfill_onboarded_targets(db, dry_run): repositories -> onboarded_targets;
dast_targets fold into the linked repo target (append LiveUrl, promote type,
relink dast_scan_runs/pentest_sessions history) or migrate standalone. Skips
existing (by _id), writes a schema_migrations marker; dry-run computes the
report without writing. Legacy collections are never deleted.
- revert(db): replay the relink log, drop onboarded_targets + the log, clear the
marker — restores the pre-migration state.
- CLI: `compliance-agent migrate onboarding [--all | --tenant <id>] [--dry-run]
[--revert]`, with DatabasePool::list_tenant_ids for --all.
- database.rs: collection_named<T> accessor + list_tenant_ids helper.
Integration test (real Mongo, local-only — CI is --lib) covers fold + relink +
idempotency + revert end to end. 5 mapper unit tests run in CI.
Closes#132.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
