Phase 2: migrate downloads/user/workflows routes onto pg

Three routes converted from the Supabase JS client to parameterised
pg queries.

backend/src/routes/downloads.ts
  - 70-line file, two db.from calls. Migrated.

backend/src/routes/user.ts
  - /user/profile (GET/POST/PATCH), /user/api-keys (GET/PUT),
    /user/account (DELETE).
  - ensureProfileRow uses INSERT ... ON CONFLICT DO NOTHING.
  - loadProfile parameterised, monthly-credit reset still applied
    inline.
  - PATCH builds the UPDATE column list dynamically from the
    supplied fields.
  - DELETE /user/account now removes the public.users row directly.
    Schema-level ON DELETE CASCADE on every owned table tears down
    the data; audit_events.user_id is ON DELETE SET NULL so history
    is preserved. Storage-object cleanup and re-auth confirmation
    land in the follow-up M1 commit.

backend/src/routes/workflows.ts
  - Largest of the three (430 lines, 15 db.from calls).
  - Sharer-name lookup no longer uses Supabase Auth admin; a single
    SELECT id, display_name, email FROM users WHERE id = ANY($1)
    returns names with fallback to email.
  - workflow_shares upsert built as a multi-row VALUES with ON
    CONFLICT (workflow_id, shared_with_email) DO UPDATE.

End-to-end verification against Postgres 16:
  - /user/profile GET auto-creates row, PATCH applies display name
    and organisation.
  - /user/api-keys GET reports state, PUT openai encrypts and
    stores, GET shows source=user.
  - /workflows POST creates, GET lists (count=1), PATCH renames,
    POST /share with two emails persists two share rows, GET
    /shares lists both, POST /hidden inserts, GET /hidden returns
    the id, DELETE /workflows/<id> returns 204.

Type-check clean. Backend boots and serves all migrated routes.

projects.ts, documents.ts, chat.ts, projectChat.ts, tabular.ts, and
chatTools.ts are next.