Unify Mike workflows in the database

From the PR description

Summary

• store every Mike-authored default and add-on workflow in the versioned mike_workflows catalog
• replace backend-startup seeding with a dedicated one-shot release job
• resolve a configured mike-workflows ref to an immutable GitHub commit, download and validate the archive, and create only an ephemeral temporary JSON document
• upload reference assets to S3-compatible storage and transactionally activate workflow rows plus reference metadata
• install editable user defaults and Quick Actions from database rows
• switch add-on, compatibility, and chat lookups to the unified table
• remove the committed backend catalog JSON and the generated systemWorkflows.ts source
• remove backend safe-error wrappers while retaining fixed generic client error responses

Deployment flow

1. Apply backend/migrations/20260823_01_unified_workflow_catalog.sql.
2. Run the built backend's npm run sync:workflows release job.
3. Start the backend, which now only reads the database and performs no catalog download or generation.

Docker Compose performs that ordering automatically with db-init, workflow-sync, and then backend. Existing Compose volumes replay the idempotent catalog migration before ingestion. Managed production deployments should pin MIKE_WORKFLOWS_REF to a 40-character commit SHA for reproducibility.

The downloader streams into a private temporary directory with compressed, extracted, per-file, workflow-count, and asset-count limits. It validates frontmatter, workflow types and keys, required defaults, packs, table columns, duplicate keys, and content hashes. Temporary archive, JSON, and extracted asset files are removed on both success and failure.

Verification

• backend TypeScript build passed
• 723 backend tests passed; 25 skipped
• coverage passed at 52.72% statements / 46.31% branches / 53.24% functions / 54.11% lines
• real GitHub source commit ce62e6a2d3f47e1d3567a4f2edc61898cfe9e78a parsed as 141 workflows: 5 defaults and 136 add-ons, with 6 references
• local Postgres and S3-compatible storage import passed twice with stable counts, confirming idempotency
• Docker Compose configuration validated
• the legacy landing generator no longer creates backend catalog JSON
• Gitleaks passed across all 378 commits reachable from the rewritten PR head