test(tenant): add regression coverage for id collision and ghost rows

Extend the tenant lifecycle and SHOW dispatch test suites to lock in the
two bugs addressed on this branch.

Id allocation tests (pgwire_auth_tenants/lifecycle.rs):
  - create_tenant_without_id_allocates_distinct_ids: two consecutive
    CREATE TENANTs without an explicit ID must receive different ids; the
    count-based allocator assigned id 1 to both, silently overwriting the
    first tenant.
  - dropped_tenant_id_is_not_reused: the id of a dropped tenant must not
    be reassigned to a subsequent CREATE TENANT.

Ghost-row tests (pgwire_show_dispatch.rs):
  - show_roles_omits_dropped_role: SHOW ROLES must not list a role after
    DROP ROLE.
  - show_tenants_omits_dropped_tenant: SHOW TENANTS must not retain the
    id-slot or name of a dropped tenant; the regression guard specifically
    checks for the empty-name ghost signature left by an orphaned admin
    user.
  - drop_tenant_refuses_when_real_users_remain: DROP TENANT must return
    42501 and name the remaining users when operator-owned accounts still
    belong to the tenant, leaving both the tenant and the users intact.

Author: farhan-syah

nodedb/tests/pgwire_auth_tenants/lifecycle.rs

@@ -20,6 +20,70 @@ async fn create_tenant() {
     assert!(events.last().unwrap().detail.contains("acme"));
 }
 
+/// Two `CREATE TENANT`s without an explicit `ID` must receive distinct
+/// ids. The pre-fix allocator derived the id from a lazily-populated
+/// traffic counter, so with no traffic every auto-allocated tenant got
+/// id 1 and the second create silently overwrote the first.
+#[tokio::test]
+async fn create_tenant_without_id_allocates_distinct_ids() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    ddl_ok(&state, &su, "CREATE TENANT alpha").await;
+    ddl_ok(&state, &su, "CREATE TENANT beta").await;
+
+    let catalog = state.credentials.catalog();
+    let catalog = catalog.as_ref().expect("catalog must be wired");
+    let a = catalog
+        .find_tenant_by_name("alpha")
+        .unwrap()
+        .expect("tenant alpha must exist");
+    let b = catalog
+        .find_tenant_by_name("beta")
+        .unwrap()
+        .expect("tenant beta must survive (not be overwritten by alpha's slot)");
+    assert_ne!(
+        a.tenant_id, b.tenant_id,
+        "two auto-allocated tenants must not share an id"
+    );
+    // Reserved slots 0 (system) and 1 (bootstrap) are never handed out.
+    assert!(a.tenant_id >= 2 && b.tenant_id >= 2, "{a:?} {b:?}");
+}
+
+/// An auto-allocated id is never reused after the tenant is dropped:
+/// the durable high-water-mark only moves forward, so a dropped id
+/// cannot be silently reassigned to a different tenant.
+#[tokio::test]
+async fn dropped_tenant_id_is_not_reused() {
+    let state = make_state_with_catalog();
+    let su = superuser();
+    ddl_ok(&state, &su, "CREATE TENANT gamma").await;
+    let catalog = state.credentials.catalog();
+    let dropped_id = catalog
+        .as_ref()
+        .unwrap()
+        .find_tenant_by_name("gamma")
+        .unwrap()
+        .expect("gamma must exist")
+        .tenant_id;
+
+    ddl_ok(&state, &su, &format!("DROP TENANT {dropped_id}")).await;
+    ddl_ok(&state, &su, "CREATE TENANT delta").await;
+
+    let reused = state
+        .credentials
+        .catalog()
+        .as_ref()
+        .unwrap()
+        .find_tenant_by_name("delta")
+        .unwrap()
+        .expect("delta must exist")
+        .tenant_id;
+    assert_ne!(
+        reused, dropped_id,
+        "a fresh tenant must not reuse a dropped tenant's id"
+    );
+}
+
 #[tokio::test]
 async fn drop_system_tenant_rejected() {
     let state = make_state();

nodedb/tests/pgwire_show_dispatch.rs

@@ -125,6 +125,140 @@ async fn show_roles_lists_created_role() {
     );
 }
 
+/// After `DROP ROLE`, `SHOW ROLES` must not list the dropped role. A
+/// `DROP` that leaves the entry visible in `SHOW` is a ghost — the
+/// catalog and the introspection view disagree on whether the role
+/// exists.
+#[tokio::test]
+async fn show_roles_omits_dropped_role() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE ROLE ghost_role_to_drop")
+        .await
+        .expect("CREATE ROLE must succeed");
+    server
+        .exec("DROP ROLE ghost_role_to_drop")
+        .await
+        .expect("DROP ROLE must succeed");
+
+    let rows = server
+        .query_named_rows("SHOW ROLES")
+        .await
+        .expect("SHOW ROLES must not error");
+
+    assert!(
+        !rows
+            .iter()
+            .any(|r| r.values().any(|v| v == "ghost_role_to_drop")),
+        "SHOW ROLES must not list a role that was dropped: {rows:?}"
+    );
+}
+
+// ── SHOW TENANTS after DROP TENANT ───────────────────────────────────
+
+/// After `DROP TENANT`, `SHOW TENANTS` must not list the dropped tenant
+/// — neither by name nor as a ghost id-slot.
+///
+/// `CREATE TENANT` auto-provisions a `<name>_admin` user in the new
+/// tenant. `SHOW TENANTS` derives its row set from the union of
+/// catalog-registered tenants and every user's `tenant_id`, so an
+/// orphaned admin user resurrects the dropped tenant as a ghost row
+/// whose `name` is empty (the catalog row is gone) but whose
+/// `tenant_id` slot is retained. The regression guard below asserts no
+/// such empty-named ghost survives for the dropped id.
+#[tokio::test]
+async fn show_tenants_omits_dropped_tenant() {
+    let server = TestServer::start().await;
+    // Explicit high id so the new tenant does not collide with the
+    // bootstrap superuser's home tenant; the auto-provisioned
+    // `<name>_admin` is then the only user in it.
+    server
+        .exec("CREATE TENANT ghost_tenant_to_drop ID 4242")
+        .await
+        .expect("CREATE TENANT must succeed");
+
+    let before = server
+        .query_named_rows("SHOW TENANTS")
+        .await
+        .expect("SHOW TENANTS must not error");
+    let tenant_id = before
+        .iter()
+        .find(|r| {
+            r.get("name")
+                .map(|n| n == "ghost_tenant_to_drop")
+                .unwrap_or(false)
+        })
+        .and_then(|r| r.get("tenant_id"))
+        .cloned()
+        .expect("created tenant must be visible in SHOW TENANTS before drop");
+
+    server
+        .exec("DROP TENANT ghost_tenant_to_drop")
+        .await
+        .expect("DROP TENANT must succeed");
+
+    let after = server
+        .query_named_rows("SHOW TENANTS")
+        .await
+        .expect("SHOW TENANTS must not error");
+
+    assert!(
+        !after.iter().any(|r| r
+            .get("name")
+            .map(|n| n == "ghost_tenant_to_drop")
+            .unwrap_or(false)),
+        "SHOW TENANTS must not list a tenant dropped by name: {after:?}"
+    );
+    // Regression guard for the specific silent failure mode: a retained
+    // id-slot with a cleared (empty) name is the ghost signature.
+    assert!(
+        !after.iter().any(|r| r.get("tenant_id") == Some(&tenant_id)),
+        "SHOW TENANTS must not retain the id-slot of a dropped tenant \
+         (ghost row with empty name): {after:?}"
+    );
+}
+
+/// `DROP TENANT` must refuse (`42501`) when an operator-owned user
+/// still belongs to the tenant, rather than orphaning it (which leaves
+/// a `SHOW TENANTS` ghost) or silently hard-deleting it. The user and
+/// the tenant must both survive the refused drop.
+#[tokio::test]
+async fn drop_tenant_refuses_when_real_users_remain() {
+    let server = TestServer::start().await;
+    server
+        .exec("CREATE TENANT keep_tenant ID 4243")
+        .await
+        .expect("CREATE TENANT must succeed");
+    server
+        .exec("CREATE USER keep_tenant_member WITH PASSWORD 'pw' TENANT 4243")
+        .await
+        .expect("CREATE USER must succeed");
+
+    let err = server
+        .client
+        .simple_query("DROP TENANT keep_tenant")
+        .await
+        .expect_err("DROP TENANT must be refused while a real user remains");
+    let code = err.code().map(|c| c.code().to_string()).unwrap_or_default();
+    assert_eq!(
+        code, "42501",
+        "DROP TENANT with a remaining real user must fail with 42501, got: {err}"
+    );
+
+    // No silent deletion: the real user must still exist.
+    let users = server
+        .query_named_rows("SHOW USERS")
+        .await
+        .expect("SHOW USERS must not error");
+    assert!(
+        users.iter().any(|r| r
+            .get("username")
+            .map(|n| n == "keep_tenant_member")
+            .unwrap_or(false)),
+        "the operator-owned user must survive a refused DROP TENANT: {users:?}"
+    );
+}
+
 // ── SHOW STATS / SHOW SERVER STATS / SHOW METRICS / SHOW MEMORY ──────
 
 /// `SHOW STATS` must reach a real handler. The session-parameter fallback