feat(spaces): add shared-space actions to workflows

[Deeds67]

Adds two shared-space actions to upstream's workflows feature: Add to space and Add to space album.

A workflow can now do things like "every upload taken near home → add it to the Family space", or "auto-curate a Holidays 2026 album inside a space, creating and linking it if it doesn't exist yet". Until now a workflow could add an asset to an album, but spaces were invisible to it.

How it fits together

Upstream's workflow engine runs each step as a method inside a WASM plugin (extism), which can only reach server data through a fixed set of host functions. So:

AssetCreate → execute()                    [upstream, untouched]
  └─ step "gallery-core#addToSpaceAlbum"
      └─ plugin-gallery wasm shim          [fork] forwards config, no logic
          └─ host fn gallery(method, args) [the seam]
              └─ GalleryWorkflowHostService [fork] validates, dispatches, never throws
                  ├─ SharedSpaceService
                  └─ AlbumService

Three properties are deliberate:

• The dispatcher calls services, never repositories, so space membership and contribution rights are enforced by exactly the code paths the HTTP API uses. The AuthDto is minted for the asset owner and forwarded untouched.
• The wasm shim carries no logic — one host call per method. Logic in a sandbox can only be tested through Docker; in a NestJS service it gets 38 unit tests.
• One generic gallery(method, args) host function, not one per action. This is what keeps the cost flat.

Cost to upstream-owned files

9 files, +27/−5. That is a one-time cost of introducing a package, not a per-feature cost — four of the nine exist purely to build and ship packages/plugin-gallery (Dockerfile, dev compose, mise.toml, CI path filters) and one is a test mock. Every future fork action or filter adds zero upstream lines.

The diff is purely additive apart from two pnpm invocations gaining a --filter and one union widening. server/src/services/index.ts is deliberately untouched: the dispatcher is built with BaseService.create and declares no events or jobs, so Nest never needs to know it exists.

The invariant worth reviewing hardest

The dispatcher must never throw for user-fixable conditions. If a host function throws, the SDK rethrows inside the sandbox, that propagates into upstream's execute() catch, and every remaining step of the workflow is abandoned. So "not a member", "no contribution rights" and "space deleted" resolve to { ok: false } and the workflow continues; genuine bugs still propagate. runGuarded splits on instanceof HttpException, and it's tested as an invariant rather than as a detail.

The same rule governs the orphan-album compensation: album.create succeeds for anyone, but linkAlbum can be denied, so a denied link deletes the album just created — never a pre-existing one — and a failure of that cleanup is swallowed rather than thrown.

Tests

• 38 server unit tests covering both handlers: name matching (trimmed, case-insensitive, oldest-wins with an id tie-break), per-space failure isolation, retry idempotency, compensation scoping, and the never-throws invariant across four exception types plus the propagation case.
• 7 web tests for the space picker, asserting the bindable prop through a test-wrapper.
• 5 e2e tests, which exist for one specific reason: if a future rebase silently drops the gallery registration from onPluginLoad, the wasm fails to instantiate and every space step stops working — while unit tests still pass, fork-patches-check only covers pnpm patches, and ci-invariants only matches patterns under .github/workflows. Four of the five go red in that scenario.

Notes for review

• Manifest title/description strings render untranslated — upstream has no i18n layer for plugin metadata. The picker's own strings are in all ten locales.
• No database migration and no OpenAPI regeneration: plugin and method rows are written by the boot-time importer, and method schemas travel as opaque jsonb.
• A failed space action is logged and skipped, with no user-facing signal. Upstream has no workflow run history at all; building one was out of scope. Follow-up territory.

Design and implementation plan are in docs/superpowers/specs/2026-08-12-spaces-in-workflows-design.md and docs/superpowers/plans/2026-08-12-spaces-in-workflows.md.