feat(context): transient (non-persisted) EventContext entries

[nicolasburtey]

Motivation

lana-bank#6740 records request IP + user agent on audit entries by carrying them through es_entity::EventContext. Side effect: every repo with event_context = true copies that metadata — personal data under GDPR — into the immutable context column of every event persisted during the request.

This PR adds a context entry flavor that behaves exactly like today's context data in-process but is never serialized out of the process.

Design

• ContextData now holds two maps: persisted and transient (field was already private — non-breaking).
• Serialization is the enforcement point: the manual Serialize impl emits only the persisted map, in the same plain-map wire format as before. Deserialize reads a plain map into persisted. Consequences:
  • Old DB rows decode unchanged; new rows are byte-identical minus transient keys. No migration, no format versioning.
  • The sqlx Encode impl and the derived repo persist path (data_for_storing()) exclude transient entries with zero changes — any future serde path is safe by construction.
• EventContext::insert_transient — mirror of insert, writes to the transient map.
• ContextData::lookup stays unified: transient first, then persisted (transient shadows on collision). Consumers work unchanged regardless of which insert produced the key, making downstream cutover painless.
• Propagation (fork / seed / WithEventContext / per-poll re-seeding) is untouched — it clones ContextData wholesale, which is exactly what carries transient entries across polls/tasks/threads.

Erasure design rule (for the docs)

• Payload PII (domain state, must be readable until erasure) → per-entity data key + codec (forgettable-payloads direction). Recoverable until shredded.
• Context PII (request metadata, observability) → transient context. Never persisted; nothing to shred later.

Testing

• Unit: transient insert/lookup roundtrip, shadowing, serde exclusion, legacy wire-format roundtrip.
• Boundary tests extended: transient entries survive fork, thread seed, tokio::spawn via WithEventContext (current-thread + multi-thread).
• New Postgres integration test asserts at the DB level that the context column contains the persisted key and lacks the transient one (create + update paths).
• CI change: nextest now runs with --features event-context — previously the context persistence path was never integration-tested in CI. The macro codegen snapshot test is feature-aware accordingly.

Versioning

Additive API, unchanged wire format → 0.10.x minor bump (0.10.41).

Out of scope (follow-up)

• #[es_event_context(transient(arg))] macro syntax.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches event-context serialization and persistence paths used on every append; wire format is unchanged but behavior for PII-bearing metadata changes materially.

Overview
Adds EventContext::insert_transient so request-scoped metadata (e.g. client IP, user agent) propagates like normal context in-process but never lands in the immutable events context column.

ContextData is split into persisted vs transient maps; a custom Serialize impl still emits only the persisted map (same JSON wire format as before), so sqlx encoding, repo persist via data_for_storing(), and existing DB rows stay compatible without migration. lookup checks transient first (shadowing persisted keys); Deserialize loads a plain map into persisted only.

Docs cover persisted vs transient context and PII/erasure guidance. CI nextest runs with --features event-context; macro snapshot test matches that default. New Postgres integration test asserts transient keys are absent from user_events.context on create and update.

^{Reviewed by Cursor Bugbot for commit 7fc397b. Bugbot is set up for automated code reviews on this repo. Configure here.}