chore(deps): track placeos-models master after auth-replacement merge

The OAuthToken model + migration that lived on the auth-replacement
branch have been merged into placeos-models master (now at 9.91.0).
Switch all three pin points back to master:

  * shard.yml — drop the `branch: auth-replacement` pin
  * shard.override.yml — drop the placeos-models override entirely
  * spec/migration/Dockerfile — `--branch master` (parameterised via
    PLACEOS_MODELS_REF build ARG so we can still target an in-flight
    branch when iterating on schema changes)

shard.lock regenerated; resolves placeos-models@9.91.0 with the
oauth_tokens migration and OAuthToken model both on master.

42/42 specs pass (./test, with --no-cache migrator rebuild).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: stakach

shard.lock

@@ -157,9 +157,9 @@ shards:
     git: https://github.com/place-labs/log-backend.git
     version: 0.13.0
 
-  placeos-models: # Overridden
+  placeos-models:
     git: https://github.com/placeos/models.git
-    version: 9.90.1+git.commit.6fec65a359cb54a6ed20e2492fbff529faedaf2c
+    version: 9.91.0
 
   pool:
     git: https://github.com/ysbaddaden/pool.git

shard.override.yml

@@ -1,11 +1,4 @@
 dependencies:
-  # placeos-models tracks the `auth-replacement` branch while migrations
-  # for authly's token store / OIDC tables land. Once those are merged
-  # into master and a release cut, this override can be removed.
-  placeos-models:
-    github: placeos/models
-    branch: auth-replacement
-
   secrets-env:
     github: spider-gazelle/secrets-env
 

shard.yml

@@ -16,10 +16,12 @@ dependencies:
   pg-orm:
     github: spider-gazelle/pg-orm
 
-  # PlaceOS data models (User, Authority, ApiKey, OAuthAuthentication, SamlAuthentication, ...)
+  # PlaceOS data models (User, Authority, ApiKey, OAuthAuthentication,
+  # SamlAuthentication, OAuthToken, ...). The `OAuthToken` migration
+  # landed on master with the auth-replacement merge, so this tracks
+  # master like the rest of the PlaceOS stack.
   placeos-models:
     github: placeos/models
-    branch: auth-replacement
 
   # OAuth2 client (replaces OmniAuth :oauth2 / :developer)
   # NOTE: must match the source `multi_auth_saml` pins transitively

spec/migration/Dockerfile

@@ -4,9 +4,12 @@ WORKDIR /app
 
 COPY . /app
 
-# auth.cr pins models to the `auth-replacement` branch while migrations
-# are landing for authly's token store and OIDC request tables.
-RUN git clone --branch auth-replacement https://github.com/PlaceOS/models
+# Pulls the latest placeos-models master and applies every migration —
+# including the `oauth_tokens` table the auth.cr token store needs.
+# Override at build time with `--build-arg PLACEOS_MODELS_REF=<branch>`
+# if you need to test against an in-flight model branch.
+ARG PLACEOS_MODELS_REF=master
+RUN git clone --branch "${PLACEOS_MODELS_REF}" https://github.com/PlaceOS/models
 RUN mv ./models/migration/db ./db
 
 ENV PATH=/app/bin:$PATH