fix(db): add ondelete="CASCADE" to 6 FK constraints that prevented tool/resource/prompt deletion after invocation

[bogdanmariusc10]

🔗 Related Issue

Closes #4478

Related Issues:

• Addresses similar FK constraint pattern as [CHORE]: Add ondelete=CASCADE to server_*_association FKs for defense-in-depth #4449 (which proposes CASCADE for server_*_association tables)
• Both issues stem from missing ondelete clauses causing FK constraint violations

---

📝 Summary

Fixed a critical bug where DELETE operations on tools, resources, and prompts would fail with sqlite3.IntegrityError: FOREIGN KEY constraint failed after the entities had been invoked at least once. The issue was caused by missing ondelete clauses on foreign key constraints in metrics and association tables, which defaulted to NO ACTION and blocked parent row deletion.

Root Cause:

• tool_metrics.tool_id, resource_metrics.resource_id, and prompt_metrics.prompt_id lacked ondelete clauses
• Association tables (server_tool_association, server_resource_association, server_prompt_association) also lacked ondelete clauses
• Once metrics were created (after first invocation), the parent entity became permanently un-deletable through the REST API

Solution:

• Added ondelete="CASCADE" to all 6 missing foreign key constraints in mcpgateway/db.py
• Created idempotent Alembic migration 9fb98535724d to update existing databases
• Metrics and association rows now automatically cascade delete when parent is removed

Impact:

• Tools/resources/prompts can now be deleted via REST API after invocation
• Consistent with existing patterns (tool_metrics_hourly, a2a_agents.tool_id already use ondelete="SET NULL")
• No manual database manipulation required

Scope vs Issue #4449:

• Issue [CHORE]: Add ondelete=CASCADE to server_*_association FKs for defense-in-depth #4449 proposes CASCADE for server_*_association FKs + cleanup code removal
• This PR implements CASCADE for both *_metrics AND server_*_association FKs
• This PR fully addresses DELETE /tools/{id} fails with FK violation after the tool has been invoked once #4478 and partially addresses [CHORE]: Add ondelete=CASCADE to server_*_association FKs for defense-in-depth #4449 (association tables only; cleanup code removal not included)

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Lint suite	make lint	✅ Pass
Unit tests	make test	✅ Pass
Coverage ≥ 80%	make coverage	✅ Pass

Manual Verification:

• Migration successfully created: 9fb98535724d_add_ondelete_cascade_to_metrics_and_.py
• Migration applied successfully: alembic upgrade head ✅
• Single migration head confirmed: alembic heads shows 9fb98535724d ✅

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (migration includes comprehensive docstrings)
• No secrets or credentials committed

---

📓 Notes

Files Changed:

1. mcpgateway/db.py - Added ondelete="CASCADE" to 6 FK constraints
2. mcpgateway/alembic/versions/9fb98535724d_add_ondelete_cascade_to_metrics_and_.py - New migration

Migration Details:

• Idempotent: Checks for table existence before modifying (supports fresh DBs)
• Cross-database: Works with both SQLite and PostgreSQL
• Reversible: Includes complete downgrade path
• Safe: Uses batch operations for SQLite compatibility

Cascade Behavior:

DELETE tool → Automatically deletes:
              - All tool_metrics rows
              - All server_tool_association rows
              
DELETE resource → Automatically deletes:
                  - All resource_metrics rows
                  - All server_resource_association rows
                  
DELETE prompt → Automatically deletes:
                - All prompt_metrics rows
                - All server_prompt_association rows

Follow-up Work (per #4449):

• Remove redundant explicit cleanup code from tool_service.py and gateway_service.py (lines 1647, 2436, 3015, 3323, 5176, etc.)
• Add real-DB FK enforcement regression tests for all four entity-delete paths
• These can be addressed in a separate PR focused on code cleanup