"""内部系统台账 (internal system registry).

The register of first-party systems the company runs — TiCard, Clinic,
docs, jira-crm, one-engine — each with a named owner. It exists because
three questions had no place to be answered:

1. **"Who owns this?"** An external vulnerability report names a host.
   Before this, matching that host to a responsible human was somebody's
   memory. Now the bounty report links to a registry entry and the owner
   (and the funding track) come with it.
2. **"Is anything ownerless?"** A system whose owner left had no signal
   at all — the person's offboarding never mentioned it.
3. **"What is externally reachable?"** The attack surface the bounty
   programme is actually about.

Deliberately NOT a second CMDB. What already exists and is not
duplicated here:

* ``cmdb_*`` — cloud infrastructure: servers, domains, DNS, certs, CDN,
  load balancers, object storage, IAM. Machine-level, provider-synced.
* ``asset_software_catalog`` — purchased SaaS with seats and bills.
* ``sso_apps`` — the SAML app catalog.
* ``domain_registrations`` — who registered an external domain.

This registry is the *application* layer above those: one row per system
we build and run ourselves, hand-maintained by IT, joined to the
infrastructure by hostname rather than owning it.
"""