v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/plan/TODO-agent-1-org-platform.md

@@ -1,13 +1,13 @@
 # TODO — Agent 1: Org Platform (invites, wizard, app profile, sharing, model grants, memory, MCP)
 
-- **Worktree:** `/projects/smart-org-wt/agent1` · **Branch:** `agent1/org-platform` (already created, already installed)
+- **Worktree:** `/home/mamad/work/smart-org-wt/agent1` · **Branch:** `agent1/org-platform` (already created, already installed)
 - **Read first:** `docs/plan/PLAN-v2.md` (all of it). Then skim: `apps/api/app/interfaces/http/routers/organizations.py`,
   `invites.py`, `admin_users.py`, `app/application/services/platform_users.py`, `app/domain/identity/models.py`,
   `apps/web/src/app/onboarding/page.tsx`, `apps/web/src/app/(app)/settings/`.
 - **Your files:** only the "Agent 1" column of PLAN-v2 §6, your block in `config.py` / `.env.example`, and the
   migration `alembic/versions/a1b2c3d4e5f1_org_platform.py` (`down_revision = "a0f0e1d2c3b4"`).
 - **Never touch:** the locked files and the other agents' files (PLAN-v2 §6). Need something there? → `CHANGE REQUEST` in your report.
-- **Do NOT commit, push, merge or rebase.** Never `cd` outside the worktree, never write to `/tmp`.
+- **Do NOT commit, push, merge or rebase.** Never `cd` outside the worktree, never write to `/tmp`. The worktree is on ext4 (the main repo under /projects is exFAT: no symlinks), so `.venv` and `node_modules` work here; do not copy files to /projects.
 - **After each phase:** run all checks (PLAN-v2 §7.4), write `docs/plan/reports/agent-1-phase-<K>.md`, then STOP and wait.
 
 You consume these contracts (do not change them): `DeployTargetTester`, `RepoWorkspacePort.test_remote`,