Backend route and lib sweep: all supabase-js call sites replaced with Drizzle

The lib layer goes first. backend/src/lib/users.ts is new: listAllUsers() returns { id, email, name }[] from the users table as a replacement for auth.admin.listUsers. It's used by the sharing features in three routes. The dead Supabase admin client factory in workflows.ts is deleted immediately after.

access.ts, userSettings.ts, documentVersions.ts, and chatTools.ts follow. All four previously accepted a db: Supa parameter so callers could pass in a client instance; after the rewrite they import the module-level Drizzle db directly and the parameter becomes _db?: unknown. Call sites in routes stop passing db entirely.

Route migrations are the bulk of the diff: downloads.ts, projectChat.ts, chat.ts, projects.ts (+799/-499), documents.ts (+927/-639), workflows.ts, and tabular.ts (+896/-698). Every route follows the same structure: import Drizzle tables and operators at the top, add *ToWire() mapper functions that translate camelCase Drizzle properties back to snake_case JSON keys, wrap each handler in try/catch. chat.ts gets explicit chatToWire() and messageToWire() helpers. projects.ts and tabular.ts are the largest files - they handle sharing, member lookup, folder structures, and complex filtering.

ed0cc46 patches an outer-catch crash in projectChat.ts: after an SSE response starts streaming, res.status(500).json() throws because headers are already sent. The fix checks res.headersSent before attempting the error response. bdb80c4 fixes buildTabularContext reading a Drizzle camelCase property (documentId) with the old snake_case key (document_id), which returned undefined silently.