store: tighten CHECK constraint on host_repo_stats.last_check_status

internal/store/migrations/0009_admin_creds_and_repo_stats.sql

@@ -50,7 +50,7 @@ CREATE TABLE host_repo_stats (
   unique_files            INTEGER,
   snapshot_count          INTEGER,
   last_check_at           TEXT,
-  last_check_status       TEXT, -- 'ok' | 'errors_found' | 'failed'
+  last_check_status       TEXT CHECK (last_check_status IS NULL OR last_check_status IN ('ok', 'errors_found', 'failed')),
   lock_present            INTEGER NOT NULL DEFAULT 0,
   last_prune_at           TEXT,
   last_prune_freed_bytes  INTEGER,

internal/store/store_test.go

@@ -138,6 +138,14 @@ func TestMigration0009Schema(t *testing.T) {
 	if lockPresent != 0 {
 		t.Errorf("expected lock_present=0, got %d", lockPresent)
 	}
+
+	// CHECK (last_check_status IN ('ok','errors_found','failed')) must reject
+	// an invalid value.
+	if _, err := s.DB().ExecContext(ctx,
+		`UPDATE host_repo_stats SET last_check_status = ? WHERE host_id = ?`,
+		"wat", "h-0009"); err == nil {
+		t.Fatal("expected CHECK constraint violation on last_check_status='wat', got nil")
+	}
 }
 
 func TestForeignKeysEnforced(t *testing.T) {