Add workspaces, computers, bot memory and the bots queue

- Schema: workspaces (+ workspace_bots, workspace_computers), containers,
  computers, bot_computers, bots.memory, workspaces.system_prompt, and
  bots_queue as a bun-sqlite isQueue table
- Main computer (and its container record) ensured with the coordinator on
  signup, seed and /admin/bots; the coordinator's access to it is locked
- Effective computer access: direct grants plus workspace computers
- Full bot prompt: core instructions, workspace prompts, then memory;
  bots can rewrite their memory and system prompt
- Queue helpers on the native BunSQLite.queue API, plus a handler that
  heartbeats, serializes per computer, recovers after restarts, reports
  lost jobs, supports cancelling and pushes outcomes over the WebSocket
- Enable SQLite foreign keys at startup so schema cascades fire
- Prune finished jobs daily

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/bots-queue/grab-locked-bot-job.ts

@@ -0,0 +1,23 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_BOTS_QUEUE } from "@/db/types/db";
+
+type Params = {
+    job_id: number | string;
+    worker: string;
+};
+
+/**
+ * A job only while the given handler still holds it. Null once its lock
+ * timed out and it went back to the queue (or another handler took it).
+ */
+export default async function grabLockedBotJob({
+    job_id,
+    worker,
+}: Params): Promise<BUN_SQLITE_COBBLE_BOTS_QUEUE | null> {
+    const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_BOTS_QUEUE>({
+        sql: `SELECT * FROM bots_queue WHERE id = ? AND status = 'processing' AND locked_by = ? LIMIT 1`,
+        values: [job_id, worker],
+    });
+
+    return res.payload?.[0] || null;
+}