v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/infrastructure/db/columns.py

@@ -0,0 +1,18 @@
+"""Column helpers shared by every ORM module (kept here to avoid import cycles)."""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.domain.base import new_id, utcnow
+
+
+def pk() -> Mapped[str]:
+    return mapped_column(String(32), primary_key=True, default=new_id)
+
+
+def created() -> Mapped[datetime]:
+    return mapped_column(DateTime(timezone=True), default=utcnow, nullable=False)