Stop the orphan sweep from deleting workspace logos

[ccfiel]

Summary

Uploaded images were disappearing and users had to re-upload them. The cause is the daily orphan sweep deleting live blobs.

sweepOrphanObjects lists objects/, attachments/ and workspaces/, then keeps anything present in a referenced set built from DocumentRevision.storageKey and Attachment.storageKey. Workspace logos are written through writeBlob, so their keys match ATTACHMENT_KEY_RE and the sweep enumerates them — but a logo is owned by Workspace.logoStorageKey, not by an Attachment row. Any logo older than the one-hour grace period was classified as crash/rollback residue and removed.

The read path then hid the evidence: on StorageNotFoundError it nulls logoStorageKey/logoContentType/logoSha, so the user sees an empty logo field rather than a broken image, and the DB retains no sign a logo was ever set. That is why this presents as "the upload sometimes doesn't stick" rather than as an error.

It is intermittent because the sweep is a setInterval(..., 24h) registered at boot and .unref()'d — it only ever fires on a process that stays up a full day. Deployments that restart frequently never trigger it; long-uptime ones lose logos every 24 hours.

• Add Workspace.logoStorageKey to the sweep's referenced set, with a comment stating the invariant: every owner of a content-addressed key must be enumerated there.
• Log a warning before the read path clears the columns, so a recurrence of this class of bug is visible in logs instead of looking like user error.
• Add a regression test, and teach the facade unit test's fake Prisma client about the new model.

Note for the cloud fork: User.signatureStorageKey has the exact same defect and is the originally reported symptom. It is cloud-only (no apps/server/src/users/ here), so it is fixed in the matching pageden-cloud PR.

Numbers

• Server unit: 171 / 171 ✓
• Integration: 429 / 429 ✓
• Typecheck: ✓
• Lint: ✓

Verification that the test catches the bug

With the sweep change reverted and the new test alone:

× keeps a workspace logo blob — it is referenced by a column, not an Attachment row
  - true
  + false      // existsSync(logo blob) — the sweep had deleted it

Passes with the fix applied.

Test plan

• pnpm -r typecheck
• pnpm -r lint
• pnpm --filter @pageden/server test
• pnpm --filter @pageden/server test:integration
• Manual: upload a workspace logo, run pnpm --dir apps/server exec tsx scripts/sweep-orphans.ts, and confirm the logo still renders afterward.
• CI: e2e + CodeQL

Note on already-affected data

Logos already swept are unrecoverable — the blobs are deleted and the pointer columns nulled. Affected workspaces need one re-upload after this ships.