feat: implement automation workflow feature

[pikann]

Summary

Adds automation workflows: a project-scoped dependency graph over existing tasks that automatically hands work off (to a human or an AI agent) as tasks move through statuses, instead of requiring someone to manually reassign every step. Delivered end-to-end — API + execution engine, a canvas-based builder in the web app, MCP tools so agents can manage workflows themselves, architecture docs, and unit/e2e test coverage.

How it works

A workflow is a directed graph of nodes (each wrapping one task) plus two shared, workflow-level lookup tables: status rules (status → assignee) and status transitions (status → next status, from which the workflow's single "done" status is derived). Two events drive automation:

1. Status changed — a task's new status is looked up in the workflow's rules; if a rule exists and the assignee differs, the task is reassigned.
2. Predecessor done — once a node's task reaches the workflow's derived done status (and, for multi-predecessor nodes, only once all predecessors have), every downstream task is reassigned using its own current status against the same rules.

Workflows are draft (freely editable) → active (engine evaluates it, graph locked) → archived (ignored, revertible to draft). Full design writeup: docs/architecture/automation-workflows.md.

Changes

API (services/api)

• New workflow domain (internal/domain/workflow): entity, errors, repository/service interfaces.
• Migration 000018_add_automation_workflows.sql: workflows, workflow_nodes, workflow_status_rules, workflow_status_transitions, workflow_edges.
• REST handler + routes for CRUD, lifecycle (activate/archive/revert-to-draft), nodes, status rules, status transitions, and edges under /projects/{projectId}/workflows, plus a read-only /tasks/{taskId}/workflows for the task-detail view.
• WorkflowConsumer (internal/worker/workflow_consumer.go): Redis-stream worker that evaluates the two automation events above and reassigns tasks accordingly.
• New workflows.read / workflows.write / workflows.* permissions, wired into default project roles.
• NotificationConsumer and AgentService.TriggerTaskAssigned extended so an AI agent that gets auto-assigned by a workflow is told which workflow assigned it and what status to set next to keep the pipeline moving.
• New WORKFLOW_* error codes and a workflow.assigned activity type (attributed to a fixed system-actor user) so the activity feed can show automation-driven reassignments.

Web UI (apps/web)

• New "Automation" section in the project sidebar; routes for the workflow list (/projects/:projectId/automation) and the canvas editor (/projects/:projectId/automation/:workflowId).
• workflow-canvas.tsx (graph builder), add-workflow-node-modal.tsx, workflow-status-rules-panel.tsx, workflow-status-transitions-panel.tsx.
• workflows-section.tsx added to the task detail modal, showing which workflows a task belongs to and linking back to them.
• workflow-api.ts client + query options.

MCP server (apps/mcp)

• workflow-client.ts + 18 new tools (list/get/create/update/delete_workflow, activate/archive/revert_workflow_to_draft, node/status-rule/status-transition/edge add/remove) so an AI agent can build and manage automation workflows itself, not just be a target of them.
• Corresponding workflows.read/workflows.write permission entries per tool.

Docs

• New docs/architecture/automation-workflows.md — core model, the two events, done-status derivation, AND-join semantics, loop safety, lifecycle, and data model.
• docs/architecture/overview.md updated to link to it.

Also included

• i18n pass over strings in the components touched while wiring up the sidebar/task-detail/notification UI, across all 8 supported locales.

Testing

• Unit: workflow_service_test.go, workflow_consumer_test.go.
• E2E (real Postgres/Redis via testcontainers): workflow_management_test.go (CRUD + lifecycle), workflow_automation_test.go (status-change reassignment, predecessor-done cascades, AND-join).
• MCP: workflow-tools.test.ts, plus updates to existing tool-suite tests for the new permission entries.