fix(config-db): grant CREATE TABLE + scoped DELETE to scadabridge_audit_purger so a segregated maintenance principal can actually run the purge

docs/plans/sql/FixAuditPurgerRoleGrants.sql

@@ -0,0 +1,29 @@
+BEGIN TRANSACTION;
+IF NOT EXISTS (
+    SELECT * FROM [__EFMigrationsHistory]
+    WHERE [MigrationId] = N'20260709105112_FixAuditPurgerRoleGrants'
+)
+BEGIN
+
+    IF DATABASE_PRINCIPAL_ID('scadabridge_audit_purger') IS NULL
+        EXEC sp_executesql N'CREATE ROLE scadabridge_audit_purger';
+    -- The switch-out dance CREATEs a staging table; ALTER ON SCHEMA::dbo alone does not
+    -- confer the database-level CREATE TABLE permission (review finding S3).
+    GRANT CREATE TABLE TO scadabridge_audit_purger;
+    -- The per-channel retention override (PurgeChannelOlderThanAsync) is a bounded row
+    -- DELETE on the maintenance path; a segregated purger principal needs this grant.
+    GRANT DELETE ON dbo.AuditLog TO scadabridge_audit_purger;
+END;
+
+IF NOT EXISTS (
+    SELECT * FROM [__EFMigrationsHistory]
+    WHERE [MigrationId] = N'20260709105112_FixAuditPurgerRoleGrants'
+)
+BEGIN
+    INSERT INTO [__EFMigrationsHistory] ([MigrationId], [ProductVersion])
+    VALUES (N'20260709105112_FixAuditPurgerRoleGrants', N'10.0.7');
+END;
+
+COMMIT;
+GO
+