Stay inactive until update.php has created the tables

[JeroenDeDauw]

An extension can be loaded on a wiki before update.php has run there — a farm switching it on
across many wikis at once does exactly that. It would arrive on wikis before any of them
has run update.php. Every entry point that reads a table now checks whether the tables are there,
and behaves as if the extension were not loaded when they are not, rather than failing with a
database error:

• the code login route offers no button, and abstains from a request submitted anyway;
• no account is reported as a member;
• the last-login record, which runs for every login on the wiki, is skipped;
• the management API answers 503 with the stable error code schema_missing.

The exception is the reader group: core's own data, and the mark provisioning puts on an account
before its roster row. While the roster cannot be read, the mark carries the rules that must not
lapse. An account holding it is refused a password — one set in that window would be a permanent
way in that the allowlist never governs — is dropped from a password reset rather than mailed a
temporary one, and where the allowlist governs single sign-on is refused that login too: an identity
provider still points at a removed member's parked account, and the roster that would clear such an
account is exactly what cannot be read. Every other account is left alone. Staff sign in through the
identity provider as before; refusing everyone would shut a working provider out of the wiki.

The check costs at most one tableExists query per request: it runs only where an entry point would
touch a table, and the answer is kept for the rest of the process, which for a web request is the
request. A wiki without the tables warns once per such process on the MemberAccess channel,
telling the administrator to run update.php. A connection that cannot answer counts as having the
tables, so an unanswerable check cannot switch the feature off on a wiki that has them. What loading
the extension changes wiki-wide is untouched: those are settings, not tables.

_{AI-authored — Claude Code, Opus 5 (max), review round by Fable 5 (max); detailed spec from @JeroenDeDauw, no redirections; diff not yet human-reviewed; test-first throughout, each guard mutation-tested by disabling it and watching its tests fail, full composer preflight green locally and CI green.}

Production notes

Commits through 49d9cd4 are the original build by Opus 5 (max). The seven commits after it are a
pr-review round by Fable 5 (max) with Opus subagents — six independent review passes, each blocking
finding adversarially verified before fixing. The review found that on a wiki whose tables go missing
after it has members (the drop-and-rerun procedure in AGENTS.md, or a partial restore), the original
head turned two fail-closed crashes into fail-opens: a temporary password mailed into a member's
mailbox, and single sign-on back into a removed member's parked account. The reader-group fallback in
ecc2162 closes both and is a semantics change against the original spec's "single sign-on is left
alone". The other review commits are ordering and probe-liveness pins and README/docblock accuracy.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 91.12903% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.62%. Comparing base (a6590ee) to head (34d3a45).

Files with missing lines	Patch %	Lines
src/MemberAccessExtension.php	67.64%	11 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master      #14      +/-   ##
============================================
+ Coverage     86.27%   86.62%   +0.35%     
- Complexity      523      551      +28     
============================================
  Files            61       62       +1     
  Lines          1807     1907     +100     
============================================
+ Hits           1559     1652      +93     
- Misses          248      255       +7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.