feat(BA-6628): assign scope-type default ranks to allow-list entries

[jopemachine]

Summary

Second half of the AppConfigFragment rank redesign (BA-6628), split out of #12516. #12516 moves the merge rank from app_config_fragments to the admin-owned app_config_allow_list with a single fixed default; this PR makes that default depend on the scope type.

• AppConfigScopeType.default_rank() — a new allow-list entry defaults its rank from its scope type: public=100, domain=200, user=300. The defaults order the scopes so a user's own fragment overrides the domain default, which overrides the public value; the 100 gap leaves room for admins to place custom ranks in between. An explicit rank still overrides the default.
• Migration 66d0f891ed20 — the backfill (added in feat(BA-6702): move fragment rank to the allow list with scope defaults #12516) switches from the fixed default to the per-scope-type defaults for existing allow-list rows.
• BEP-1052 — documents the scope-type defaults and the "user fragment wins by default" behavior.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. feat(BA-6702): move fragment rank to the allow list with scope defaults #12516 — feat(BA-6628): move fragment rank to the allow list
7. 👉 feat(BA-6628): assign scope-type default ranks to allow-list entries #12539 — feat(BA-6628): assign scope-type default ranks to allow-list entries ← you are here
8. feat(BA-6701): expose allow-list rank on the v2 API surface #12517 — feat(BA-6628): expose allow-list rank on the v2 API surface
9. feat(BA-6704): cascade app config subtree deletion from the definition #12518 — feat(BA-6628): cascade fragment deletion from the allow list
10. feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
11. feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): AppConfigFragment bulk CRUD service layer
12. feat(BA-6555): AppConfig merge engine + resolve service (service layer) #12359 — feat(BA-6555): app_config service layer (merge engine)
13. feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API

🤖 Generated with Claude Code