refactor(kiloclaw): drop retired managed Composio storage

[pandemicsyn]

Summary

• Drop the retired kiloclaw_composio_identities table and kiloclaw_instances.composio_config_source marker after managed Composio onboarding was removed in refactor(kiloclaw): removed managed Composio onboarding #3543 and the stored experiment residue is no longer needed.
• Remove the corresponding GDPR soft-delete operation while retaining a reduced .specs/kiloclaw-composio.md contract for the still-supported manual Settings credential path.
• Add a Drizzle-generated migration that deletes stored managed identity credential/account residue and removes the instance marker column and constraint.

Verification

• Inspected production managed Composio state before preparing this cleanup: managed identity/table residue exists, while no existing live machine requires managed-secret cleanup.
• Deployed a new instance and confirmed it came online successfully.
• Changed models successfully on the new instance.
• Paired Telegram and confirmed two-way communication through Telegram.
• Ran openclaw doctor; it reported only a cosmetic kilo-chat plugin warning because its manifest does not yet declare channelConfigs metadata. This does not affect runtime communication and can be addressed after this cleanup ships.

Visual Changes

N/A

Reviewer Notes

• Depends on merged PR refactor(kiloclaw): removed managed Composio onboarding #3543, which removed the endpoints capable of writing managed Composio state; this PR is now based directly on main.
• The generated migration intentionally deletes retired encrypted identity data and connected-account residue identified during production inspection.
• Accepted rollout risk: during the narrow migration-to-web-deploy window, an account soft-delete served by the pre-deploy web build could still query the dropped managed identity table. This is considered sufficiently unlikely for this cleanup and is not split into an additional intermediate deployment.
• Follow-up: add channelConfigs metadata to the kilo-chat plugin manifest to remove the cosmetic openclaw doctor setup-surface warning; Telegram runtime pairing and communication were verified working.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review (since 07e8649a) confirms no new issues: the single new commit adds one clarifying sentence to .specs/kiloclaw-composio.md stating that removing retired managed persistence does not alter the manual Settings contract — a correct and unambiguous documentation improvement with no code changes.

Files Reviewed (7 files)

• .specs/kiloclaw-composio.md — incremental: one sentence added to "Role of This Document" clarifying that dropping retired managed persistence does not affect the manual Settings contract; correct
• apps/web/src/lib/user/index.ts — kiloclaw_composio_identities import and GDPR soft-delete step removed correctly
• packages/db/src/migrations/0147_curvy_millenium_guard.sql — generated migration: DISABLE RLS, DROP TABLE CASCADE, DROP CONSTRAINT, DROP COLUMN; all correct
• packages/db/src/migrations/meta/0147_snapshot.json — prevId correctly chains to 0146 snapshot; no kiloclaw_composio_identities remains
• packages/db/src/migrations/meta/_journal.json — 0147 entry appended sequentially; breakpoints set correctly
• packages/db/src/schema.ts — KiloClawComposioInstanceConfigSource type, composio_config_source column + check constraint, and full kiloclaw_composio_identities table definition removed

---

_{Reviewed by claude-sonnet-4.6 · 308,305 tokens}

_{Review guidance: REVIEW.md from base branch main}