As a swatch maintainer, I'd like swatch to automatically reconcile subscriptions when the denylist is changed, without requiring a manual syncing process.

In order to handle this, swatch should store the denylist in a table, and provide Create/Retrieve/Delete internal rest API methods for managing SKUs on the denylist. We should populate initial contents from our existing denylist (via a liquibase migration).

Addition to the denylist should remove all subscription records and offering records for that SKU.

Removal from the denylist should sync the offering and then sync subscriptions by SKU across all opted-in orgs. The subscription client doesn't currently expose a search criteria for SKU (see private comment for references). We should additionally expose this functionality for support purposes in a method named syncAllSubscriptionsBySku on the internal API. An attempt to sync a SKU that is on the denylist should remove all subscription records and offering records for that SKU.

Moving forward the database becomes the source-of-truth for the denylist.

The internal API becomes the exclusive process to update the denylist.

Done:

• Denylist populated in DB
• syncAllSubscriptionsBySku internal API implemented in subscription sync
• Create/Retrieve/Delete Internal APIs implemented in subscription-sync
• Denylist maintenance documented