Merge origin/license-app-only-implicit-promotion into guest-jwt-app-entry

Parent moved (OSS 6081e286c9, EE 32841072aa). The EE change dropped
clear_guest_target_for_state (the OAuth guest cookie is state-bound and never
cleared by a callback); the OSS change was docs/tests on the guest_activity
delete. Keep this branch's ee-repo-ref at the EE companion head.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

backend/ee-repo-ref.txt

@@ -1 +1 @@
-dc5cba65ada44b3d6a509c82717a0b577aae7d57
+abe587e0abeddaa591289f06b4ce91ef602ffb65

backend/tests/app_guest_allowance.rs

@@ -94,6 +94,17 @@ async fn the_allowance_caps_strangers_and_meters_an_enterprise_plan(
     mint(&db, "g1@example.com")
         .await
         .expect("a guest already in the window is let back in");
+    let recorded: bool = sqlx::query_scalar(
+        "SELECT EXISTS(SELECT 1 FROM guest_activity
+                       WHERE email = 'g1@example.com' AND workspace_id = 'test-workspace'
+                         AND day = CURRENT_DATE AND last_seen_at > now() - interval '1 minute')",
+    )
+    .fetch_one(&db)
+    .await?;
+    assert!(
+        recorded,
+        "the mint writes the guest_activity row the allowance is counted on"
+    );
 
     let list: serde_json::Value = authed(
         client().get(format!(

backend/windmill-api-workspaces/src/workspaces_extra.rs

@@ -1119,6 +1119,8 @@ pub(crate) async fn delete_workspace(
     .execute(&mut *tx)
     .await?;
 
+    // Unlike the rest of this list, this also moves an instance-wide figure: the guest
+    // allowance and the seats past it are counted over every workspace's rows.
     sqlx::query("DELETE FROM guest_activity WHERE workspace_id = $1")
         .bind(&w_id)
         .execute(&mut *tx)