feat(platform): move the platform off Convex onto Postgres

[larryro]

Replaces the Convex runtime with a Node + Hono + Postgres backend. The
running stack has no Convex process, service, control channel, or client
runtime; the app has its own wire contract; the reused 0.4 handler bodies
run against a SQL-backed ctx shim.

services/platform/backend/MIGRATION.md is the campaign's source of
truth — one row per domain, one row per teardown step, each naming what
landed and what was found en route. 94 done / 5 dropped / 1 pending.

What this is

	main	0.5
Backend	Convex deployment	213 modules under backend/, 57 SQL migrations applied at boot under an advisory lock
convex/ tree	1593 .ts	535 .ts — the reused handler bodies and what they reach
Convex runtime	the stack	none: no service, no image base, no CLI lane, no client
Jobs	Convex scheduler	pg-boss
Live updates	Convex WS subscriptions	SSE hint bus

The port is domain-by-domain, not a rewrite: where a 0.4 handler body was
correct, it is REUSED verbatim behind a ctx shim that dispatches a
function NAME to a SQL handler. That is why the diff deletes twice what
it adds — the decision logic mostly survives; the runtime under it does
not.

Gates

Run on the tip, each with its own exit code checked:

• tsc --noEmit — 0
• oxlint --type-aware — 0
• server suite — 72 212 tests, 364 files
• UI suite — 3436 tests, 445 files
• integration — 256/256 against a real Postgres + MinIO

The integration run is the one that matters: it exercises every door
end-to-end against a throwaway database, including the machine journey
(presigned upload → bind → listing → content roundtrip), the automation
stepper, the task-agent arc, SSO/SCIM, governance holds and retention,
the WebDAV lane, and the in-sandbox bridges.

What is deliberately NOT done

The one pending row. convex is still in package.json, used as a
LIBRARY, not a runtime: v / Infer / GenericId from convex/values
type the reused handlers' argument contracts across 32 modules. Nothing
imports it from backend/ or lib/. Those validators become plain
TypeScript or zod as each domain ports, and then the reuse set moves out
of convex/ and the package leaves.

Also priced rather than hidden, in the ledger: WebDAVBackend's three
methods return any — exactly what the retired client's generic
resolved to for a name-addressed call, so nothing about strictness
changed here. Tightening it means declaring shapes at 66 call sites and
updating handler stubs that return partial ones; that is its own change.

Review notes

The ledger rows carry the reasoning, including the traps worth knowing
before touching this code:

• The second dependency graph. Reused bodies call each other by NAME
  through the shim (internal.x.y.z) with no import to follow. Any
  closure analysis must walk static imports, dynamic await import(),
  AND api-object references — a naive import closure was wrong by 350
  files.
• A wrapper can carry behaviour its impl does not. One real loss
  found and fixed this way: the connectors bridge's forensic audit lived
  in the 0.4 wrapper, and the 0.5 door calls the impl directly.
• _generated/ is hand-maintained now. Adding a name there without
  giving the shim a handler for it is a runtime refusal waiting to
  happen.