Modularity fix: yetki no longer creates its own 'users' table or foreign-
key references to one. Identity lives in the app (or anahtar), and yetki
references user_id as a plain TEXT column.

- Default tablePrefix is now 'yetki_' (was '') so tables are:
yetki_roles, yetki_subscriptions, yetki_purchases, yetki_grants
- d1Adapter accepts usersTable / usersIdColumn / usersDisplayColumn
(defaults: auth_users / id / email — anahtar-friendly) to populate
the d1dash descriptor's entity pointer
- getUser removed from YetkiAdapter (yetki doesn't own users)
- buildDescriptor now takes DescriptorOptions instead of a bare prefix
- Tests updated; new integration.test.ts validates the full d1dash flow
(init -> execute mark_internal SQL from the descriptor -> resolveAccess
reflects flags.internal=true)
- Added README section on the identity-ownership boundary

- resolver.test.ts: pure unit tests for computeAccess covering defaults,
flag derivation, internal/all_access overrides to Infinity, extra_language
stacking, plan_limits, custom default_limits, pass-through grant types,
and role projection (11 cases)
- db/d1.test.ts: adapter integration tests run against a bun:sqlite-backed
D1 shim — init creates all tables, registers yetki in _d1dash_modules,
is idempotent, honors tablePrefix; getActiveGrants filters revoked/expired;
getActiveSubscription ignores canceled; round-trips users+roles (8 cases)
- src/_test/d1-from-sqlite.ts: thin shim wrapping bun:sqlite in D1's
prepare/bind/first/all/run interface for test use only

19 passing. Runs with `bun test`. tsconfig types updated for @types/bun.

Note: user asked for "bunwright" — that's a WebView automation CLI, not a
test runner, and yetki is headless. Using bun test (Bun's native runner)
as the pragmatic read of the intent.

yetki ships:
- Schema: users, user_roles, user_subscriptions, user_purchases, user_access_grants
- D1 adapter with idempotent init() that also self-registers in _d1dash_modules
so d1dash detects the module and exposes manual-override actions automatically
- resolveAccess(adapter, userId, policy) -> { flags, limits, roles, plan, reasons }
- Exported d1dash descriptor with initial actions:
mark_internal, grant_all_access, grant_extra_language

Proof of concept. LLM-assisted. MIT.