Add workspaces, computers, bot memory and the bots queue

- Schema: workspaces (+ workspace_bots, workspace_computers), containers,
  computers, bot_computers, bots.memory, workspaces.system_prompt, and
  bots_queue as a bun-sqlite isQueue table
- Main computer (and its container record) ensured with the coordinator on
  signup, seed and /admin/bots; the coordinator's access to it is locked
- Effective computer access: direct grants plus workspace computers
- Full bot prompt: core instructions, workspace prompts, then memory;
  bots can rewrite their memory and system prompt
- Queue helpers on the native BunSQLite.queue API, plus a handler that
  heartbeats, serializes per computer, recovers after restarts, reports
  lost jobs, supports cancelling and pushes outcomes over the WebSocket
- Enable SQLite foreign keys at startup so schema cascades fire
- Prune finished jobs daily

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/create-key-lock.ts

@@ -0,0 +1,32 @@
+type RunParams<T> = {
+    key: string | number;
+    task: () => Promise<T>;
+};
+
+/**
+ * An in-process lock per key: tasks with the same key run one at a time in
+ * call order, tasks with different keys run side by side. Used so two jobs
+ * never drive the same computer at once.
+ */
+export default function createKeyLock() {
+    const tails = new Map<string, Promise<unknown>>();
+
+    async function run<T>({ key, task }: RunParams<T>): Promise<T> {
+        const id = String(key);
+        const previous = tails.get(id) || Promise.resolve();
+        const current = previous.catch(() => {}).then(task);
+        const tail = current.catch(() => {});
+
+        tails.set(id, tail);
+
+        try {
+            return await current;
+        } finally {
+            if (tails.get(id) === tail) {
+                tails.delete(id);
+            }
+        }
+    }
+
+    return { run, size: () => tails.size };
+}