fix: Connect seed-dev demo operator seeder to identity database

[bjcoombs]

Summary

`seedDemoOperator` (added in #2137) used `DATABASE_URL` directly, which points to `meridian_platform`. The identity repository needs `meridian_identity` where the `org_` schemas contain the identity tables. Derive the correct DSN by replacing the database component.

Evidence

Demo deploy on 8d9b639 - manifest applied successfully, then:
```
ERROR tenant scope: schema not provisioned schema=org_volterra_energy
Error: seed demo operator: seed demo users: seeding demo user operator@volterra.energy:
checking for existing demo user: tenant schema not provisioned: schema does not exist in database: org_volterra_energy
```
The `org_volterra_energy` schema exists in `meridian_identity` but not in `meridian_platform` (where `DATABASE_URL` points).

Fix

Add `replaceDatabase(baseDSN, "meridian_identity")` to swap the database component before connecting, matching how the main binary routes per-service connections via `ServiceDatabases`.

Test plan

• `go build ./...` + `go test -short ./cmd/seed-dev/...` pass
• CI green
• After merge + push to demo: seed-dev creates `operator@volterra.energy` successfully, Dex login works

[coderabbitai]

Warning

Rate limit exceeded

@bjcoombs has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 5 minutes and 52 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 5 minutes and 52 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 576c90f1-dc26-45b2-b292-a2645a55c360

📥 Commits

Reviewing files that changed from the base of the PR and between 328fdee and 33b11f1.

📒 Files selected for processing (1)

• cmd/seed-dev/cmd/root.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-seed-dev-identity-dsn

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude Code Review

Commit: 33b11f1 | CI: running (most checks pending)

Summary

Clean, well-scoped bug fix. The seedDemoOperator function was connecting to meridian_platform (via DATABASE_URL) but the identity tables live in meridian_identity. The fix correctly derives the identity DSN using replaceDatabase(), mirroring the established replaceDSNDatabase() pattern in cmd/meridian/connections.go:50-58.

The PR description provides clear evidence (the exact error from demo deploy), and the fix is minimal and targeted.

Risk Assessment

Area	Level	Detail
Blast radius	Low	Only affects seed-dev CLI tool, not production services
Rollback	Safe	Single commit, no schema changes, trivially revertable
Scale	N/A	One-shot CLI tool, not a running service
Cross-system	Low	Uses same DSN derivation pattern as main binary
Migration	N/A	No migrations

Findings

Severity	Location	Description	Status
Note	root.go:439-448	replaceDatabase duplicates replaceDSNDatabase in cmd/meridian/connections.go:50-58. Acceptable for a CLI tool -- extracting to shared would over-couple.	Acknowledged
Note	root_test.go	No unit test for replaceDatabase. The function is trivial (3 lines wrapping url.Parse) and the same logic is battle-tested in connections.go, so this is not blocking.	Acknowledged

Test Coverage

No test changes in this PR. replaceDatabase is a 3-line function wrapping url.Parse + path replacement -- the same pattern tested in production via connections.go. The real validation is the end-to-end demo deploy (noted in the PR test plan).

Bot Review Notes

No unresolved bot review threads found.

[claude]

Straightforward bug fix. The DSN derivation follows the established pattern from connections.go. No correctness, security, or domain-level concerns. Two informational notes in the summary comment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!