Add workspaces, computers, bot memory and the bots queue

- Schema: workspaces (+ workspace_bots, workspace_computers), containers,
  computers, bot_computers, bots.memory, workspaces.system_prompt, and
  bots_queue as a bun-sqlite isQueue table
- Main computer (and its container record) ensured with the coordinator on
  signup, seed and /admin/bots; the coordinator's access to it is locked
- Effective computer access: direct grants plus workspace computers
- Full bot prompt: core instructions, workspace prompts, then memory;
  bots can rewrite their memory and system prompt
- Queue helpers on the native BunSQLite.queue API, plus a handler that
  heartbeats, serializes per computer, recovers after restarts, reports
  lost jobs, supports cancelling and pushes outcomes over the WebSocket
- Enable SQLite foreign keys at startup so schema cascades fire
- Prune finished jobs daily

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/bots-queue/run-bot-job.ts

@@ -0,0 +1,14 @@
+import type { BotJobRunner } from "./types";
+import BotJobFatalError from "./bot-job-fatal-error";
+
+/**
+ * Does a job's actual work: the bot follows `job.instructions` with its
+ * full prompt (`grabBotPrompt`), on `job.computer_id` if set, and returns
+ * the message for the user. This is where the model layer plugs in; until
+ * it exists every job fails at once and the user is told.
+ */
+const runBotJob: BotJobRunner = async () => {
+    throw new BotJobFatalError(`Bots can't run queued work yet.`);
+};
+
+export default runBotJob;