feat(server): clean up dirty data from legacy version (#15078)

#### PR Dependency Tree


* **PR #15078** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Persist and replay incoming payment webhooks for reliability.
* Track provider-level subscriptions, payment events, and per-target
trial usage across providers.
  * Nightly replay job to reprocess stuck payment events.
* Shadow backfill mode and emit-suppression options to control
projection/backfill side effects.
  * Subscriptions now derived from entitlements + provider facts.

* **Bug Fixes**
* Improved error propagation, retry tracking, and safer owner-grant
projection handling.

* **Tests**
* Added webhook failure/replay, provider integration, entitlement
projection, and trial/checkout tests.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/models/permission-projection.ts

@@ -268,6 +268,20 @@ export class PermissionProjectionModel extends BaseModel {
       `;
 
         await tx.$executeRaw`
+        WITH legacy_doc_grants AS (
+          SELECT
+            workspace_id,
+            page_id,
+            user_id,
+            type,
+            created_at,
+            row_number() OVER (
+              PARTITION BY workspace_id, page_id, affine_permission_legacy_doc_role(type)
+              ORDER BY created_at ASC, user_id ASC
+            ) AS role_rank
+          FROM workspace_page_user_permissions
+          WHERE affine_permission_legacy_doc_role(type) IS NOT NULL
+        )
         INSERT INTO doc_grants (
           workspace_id,
           doc_id,
@@ -291,8 +305,12 @@ export class PermissionProjectionModel extends BaseModel {
           user_id,
           created_at,
           now()
-        FROM workspace_page_user_permissions
+        FROM legacy_doc_grants
         WHERE affine_permission_legacy_doc_role(type) IS NOT NULL
+          AND (
+            affine_permission_legacy_doc_role(type) <> 'owner'
+            OR role_rank = 1
+          )
         ON CONFLICT (workspace_id, doc_id, principal_type, principal_id)
         DO UPDATE SET
           role = EXCLUDED.role,