fix(backend): harden the workflow and quick-action routes

WHY THIS MATTERS
The new routers were correct on the happy path but leaked or mis-handled
several edge cases a public API will hit:

- Quick actions created against a shared workflow survived share
  revocation: the list path re-fetched workflow titles by bare id with no
  access re-check, so a revoked user kept a live row (title included) for a
  workflow they can no longer open. withWorkflowDetails now verifies the
  caller still owns or has a share for each workflow and drops
  inaccessible quick actions (PATCH returns 404 in that case).
- sort_order above 2^31-1 passed Number.isInteger and blew up as a 500 on
  the int4 column; it is now a 400 with a clear message. WHAT IS int4?
  Postgres integer is 32-bit - API validation must enforce the column's
  real range, not JavaScript's.
- Workflow DELETE removed R2 storage objects BEFORE the DB delete; a DB
  failure left rows pointing at deleted storage. Order flipped: DB rows
  first, storage cleanup only for rows actually removed (same
  partial-failure logic as the replication commit).
- Neither new router had the tail error middleware the workflows router
  has, so thrown errors rendered Express's HTML 500 instead of the API's
  {detail} JSON contract. Both routers now share the pattern.
- POST /workflow-addons/:addonId/import performs storage downloads and
  uploads but was missing from the uploadLimiter list; added.
- Add-on import inserted explicit nulls for language/practice/
  jurisdictions, bypassing the column defaults every other creation path
  gets; now coalesced to 'English' / 'General Transactions' / ['General'].
- Removed a provably-dead filter (SYSTEM_WORKFLOW_IDS can never match DB
  UUIDs) that implied system rows could appear in the database.

Found by review of PR #309.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4PXCdenNH5Mqhm5Sre9Zs