Unify private research identity, API and PostgreSQL budgets

[gilbertsahumada]

Problem and behavior

Product workspaces and research tenants previously had separate identities, and the deployed API depended on a Durable Object budget authority. This change adds explicit private mappings, idempotent owner-controlled agent creation, JWT-only console routes, and a transactional PostgreSQL monetary ledger.

Registration does not enable provider usage. Operator revocation prevents admission and late research writes. Managed agents require their own configuration-version connection check before scheduling. Alpha/beta remain isolated laboratory tenants. Existing Durable Object state is retained and requires verified reconciliation before importing legacy budget authority.

Growth endpoints now have Hono implementations preserving their DTOs and secure apply cookie. Public demo reads remain sample data. API composition is request-scoped, uses Hyperdrive, and does not import Mastra or require LLM keys.

Validation

• 240 tests passed against isolated Supabase-local databases; the earlier 238-test PostgreSQL run passed before the final two revocation/readiness tests were added.
• Empty, research-only and product-only migration histories verified.
• Concurrent creation, independent budget connections, idempotency, access revocation and cookie regression tests.
• Format, lint, workspace type checks and API Worker dry-run compilation passed.
• No paid provider calls or remote deployment.

Delivery boundaries

First of three sequential PRs, based on #23. The next PR switches Next.js to API transport, adds the console, and extracts the shared research runtime. The final PR configures and verifies the three-Worker staging deployment. Existing Next.js handlers remain until that switch; this PR alone is not a completed staging release. No production deployment or automatic merge.