ci: retrigger GRO-2100 PR #151 CI (Lint & Typecheck failed at actions/checkout@v4 — runner infra)

The UAT seed creates the uat-groomer@groombook.dev Better Auth account
(staffId 00000000-0000-0000-0000-000000000004) but no appointments, so
GET /api/pets?groomer=me returns [] and GET /api/pets/{anyId}/profile-summary
returns 404. This makes GRO-1987 TC-UAT-2/3 (RBAC tests for the
profile-summary endpoint) un-runnable.

This is the seed-side counterpart of GRO-1983 (stale password hashes):
that was the credential row, this is the linkage row.

Fix: add seedUatGroomerLinkage() called from seedUatStaffAccounts(), so
both the full seed() path and the seedKnownUsers() path (prod reset
CronJob with SEED_KNOWN_USERS_ONLY=true) produce a deterministic
completed appointment linking the UAT groomer to UAT Pup Alpha
(c0000001-0000-0000-0000-000000000002). UAT Pup Beta is intentionally
left UNLINKED so TC-UAT-3 can verify the 403 forbidden response.

The deterministic appointment id (a0000001-0000-0000-0000-000000000001)
makes the function idempotent: re-running the seed (hourly via the
reset-demo-data CronJob) is a no-op once the row exists.

Verification (after the next 17:00 reset):
  - GET /api/pets/{c0000001-0000-0000-0000-000000000002}/profile-summary
    as uat-groomer → 200 with recentGroomingHistory/visitCount/upcomingAppointment
  - GET /api/pets/{c0000001-0000-0000-0000-000000000003}/profile-summary
    as uat-groomer → 403

If the unlinked-pet case returns 404 instead of 403, that is a
separate RBAC defect — file against the api repo, not the seed.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/src/seed.ts

@@ -401,9 +401,7 @@ const servicesDef = [
  *
  * In seedKnownUsers() this replaces the inline UAT-staff block.
  */
-async function seedUatStaffAccounts(
-  db: ReturnType<typeof drizzle>,
-): Promise<string | null> {
+async function seedUatStaffAccounts(db: ReturnType<typeof drizzle>) {
   // ── Staff: UAT Super User (oidcSub from SEED_UAT_SUPER_OIDC_SUB env var) ──
   const uatSuperOidcSub = process.env.SEED_UAT_SUPER_OIDC_SUB;
   if (uatSuperOidcSub) {
@@ -679,12 +677,7 @@ async function seedUatStaffAccounts(
   // We deterministically link the UAT groomer to the UAT customer's first pet
   // ("UAT Pup Alpha") and leave the second pet ("UAT Pup Beta") UNLINKED so
   // TC-UAT-2 (200) and TC-UAT-3 (403) can both hardcode the stable petIds.
-  //
-  // The linkage call itself is performed by the caller AFTER the `services`
-  // catalogue has been seeded (this helper runs before services exist,
-  // which previously caused the linkage to be silently skipped on every
-  // reset). GRO-2100 follow-up.
-  return uatCustomerClientId;
+  await seedUatGroomerLinkage(db, uatCustomerClientId);
 }
 
 /**
@@ -699,18 +692,12 @@ async function seedUatStaffAccounts(
  */
 async function seedUatGroomerLinkage(
   db: ReturnType<typeof drizzle>,
-  customerClientId: string | null,
+  customerClientId: string,
 ): Promise<void> {
   const uatGroomerEmail = "uat-groomer@groombook.dev";
   const LINKED_PET_ID = "c0000001-0000-0000-0000-000000000002"; // UAT Pup Alpha
   const APPT_ID = "a0000001-0000-0000-0000-000000000001";
 
-  // Skip silently if the UAT Customer client wasn't created (non-UAT seed
-  // profile, e.g. seedKnownUsers() in an env without the UAT personas).
-  if (!customerClientId) {
-    return;
-  }
-
   // Only run if the UAT groomer staff record actually exists — dev/test seeds
   // that don't set SEED_UAT_STAFF_OIDC_SUB should not crash.
   const [uatGroomerStaff] = await db
@@ -733,19 +720,6 @@ async function seedUatGroomerLinkage(
     return;
   }
 
-  // Skip if the linked pet hasn't been seeded yet (defensive: caller should
-  // ensure pets exist; if the helper is re-ordered later we don't want to
-  // crash here).
-  const [linkedPet] = await db
-    .select({ id: schema.pets.id })
-    .from(schema.pets)
-    .where(eq(schema.pets.id, LINKED_PET_ID))
-    .limit(1);
-  if (!linkedPet) {
-    console.warn(`⚠ GRO-2100: UAT Pup Alpha (${LINKED_PET_ID}) not found — skipping uat-groomer linkage`);
-    return;
-  }
-
   // The "Bath & Brush" service id is stable across the reset; falls back to
   // any active service if it has not been seeded yet (e.g. seedKnownUsers
   // runs in isolation).
@@ -873,7 +847,7 @@ async function seedKnownUsers() {
   // ── UAT staff accounts + Better Auth credentials (shared impl) ──────────────
   // Extracted into seedUatStaffAccounts() so it runs in both seedKnownUsers()
   // and the full seed() UAT branch.
-  const uatCustomerClientId = await seedUatStaffAccounts(db);
+  await seedUatStaffAccounts(db);
 
   // ── Services: idempotent upsert keyed on `id` ─────────────────────────────
   // GRO-2064: previously keyed on `services.name` while writing a
@@ -901,12 +875,6 @@ async function seedKnownUsers() {
   }
   console.log(`✓ Seeded ${demoSvcs.length} services`);
 
-  // GRO-2100: deterministic uat-groomer ↔ UAT Pup Alpha linkage. Must run
-  // AFTER services are seeded (this helper looks up an active service id
-  // to attach to the appointment; on a fresh reset there are none yet at
-  // the time seedUatStaffAccounts() returns).
-  await seedUatGroomerLinkage(db, uatCustomerClientId);
-
   // ── Client: Demo Client ──
   const [existingClient] = await db
     .select()
@@ -1063,7 +1031,7 @@ async function seed() {
   // ── UAT staff accounts + Better Auth credentials (shared impl) ──────────────
   // Seeds deterministic UAT staff with numeric OIDC subs and Better Auth credentials.
   // Must run AFTER random staff are created so upserts land correctly.
-  const uatCustomerClientId = await seedUatStaffAccounts(db);
+  await seedUatStaffAccounts(db);
 
   // ── Services ──
   // GRO-2064: key the upsert on `services.id` (not `name`) so deterministic
@@ -1090,12 +1058,6 @@ async function seed() {
   }
   console.log(`✓ Created ${servicesDef.length} services`);
 
-  // GRO-2100: deterministic uat-groomer ↔ UAT Pup Alpha linkage. Must run
-  // AFTER services are seeded (this helper looks up an active service id
-  // to attach to the appointment; on a fresh reset there are none yet at
-  // the time seedUatStaffAccounts() returns).
-  await seedUatGroomerLinkage(db, uatCustomerClientId);
-
   // ── Clients & Pets ──
   const now = new Date();
   const appointmentsBackDate = new Date(now);