feat: establish secure update foundation

internal/store/store.go

@@ -13,6 +13,7 @@ import (
 
 	_ "github.com/mattn/go-sqlite3"
 
+	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/config"
 	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/model"
 )
@@ -128,6 +129,13 @@ func (s *Store) migrate(ctx context.Context) error {
 		300, mustJSON([]string{config.DefaultIPv4Primary, config.DefaultIPv4Fallback}), mustJSON([]string{config.DefaultIPv6Primary, config.DefaultIPv6Fallback}), now()); err != nil {
 		return err
 	}
+	var appliedMigrations int
+	if err := tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM schema_migrations WHERE version BETWEEN 1 AND ?`, buildinfo.CurrentSchemaVersion).Scan(&appliedMigrations); err != nil {
+		return err
+	}
+	if appliedMigrations != buildinfo.CurrentSchemaVersion {
+		return fmt.Errorf("database migration chain is incomplete: have %d of %d", appliedMigrations, buildinfo.CurrentSchemaVersion)
+	}
 	return tx.Commit()
 }
 
@@ -861,6 +869,11 @@ func (s *Store) SetDesiredSoftwareVersion(ctx context.Context, version string) e
 	return err
 }
 
+func (s *Store) ClearDesiredSoftwareVersion(ctx context.Context, expected string) error {
+	_, err := s.db.ExecContext(ctx, `UPDATE software_update_settings SET desired_version = '', updated_at = ? WHERE id = 1 AND desired_version = ?`, now(), expected)
+	return err
+}
+
 func (s *Store) UpdateRunState(ctx context.Context, ipv4, ipv6, status string) error {
 	_, err := s.db.ExecContext(ctx, `UPDATE settings SET
 last_ipv4 = COALESCE(NULLIF(?, ''), last_ipv4),