[adm 5.3] Generate database migrations from canonical generated APIs

[artiphishle]

Closes #8
Part of ankhorage/studio#120.

Scope

• consume the released @ankhorage/contracts@^4.0.2 canonical AppManifest.generatedApis desired state
• replace the historical manifest.data.apis reader
• generate deterministic Supabase/Postgres database artifacts from generated API resources
• preserve schema/table names, primary keys, fields, required/unique flags and safe scalar defaults
• map uuid, text, number, boolean, datetime and json to provider-owned SQL types
• materialize deterministic UUID primary keys for seed records when needed
• reject invalid identifiers, duplicate fields/resources/physical targets, invalid primary keys/defaults and invalid seed records with structured diagnostics
• enable RLS when explicit policy intent exists, but do not invent provider policy expressions absent from the canonical contract
• remove the obsolete Infra-owned generated app handler, memory-store and OpenAPI artifact surface

Architecture boundary

This PR is only the generated API -> database infrastructure bridge.

It deliberately does not generate:

• a Fastify or GraphQL server
• an API generator adapter placeholder
• Docker images for an API service
• Kubernetes Deployments/Services for an API service
• src/generated/apis/appApi.ts
• src/generated/apis/apiHandlers.ts
• src/generated/apis/openapi.json
• a compatibility reader for manifest.data.apis

Normalized endpoint/operation metadata remains owned by @ankhorage/data-sources; physical database artifacts remain owned here.

Policy boundary

The current canonical GeneratedApiOperationPolicyRef carries policy identity/operation intent, but no provider SQL expression. Infra therefore enables RLS when policy intent is explicit and emits a diagnostic warning rather than fabricating CREATE POLICY ... USING (...) semantics.

Validation

Behavior-focused tests cover deterministic artifact generation, SQL type/default/constraint mapping, deterministic seed UUIDs, RLS intent, invalid definitions, duplicate physical targets, no generated API service workload, and no artifacts when generated APIs are absent.

Because GitHub Actions are currently unavailable, the final Bun/Paradox/lockfile validation will be run locally before this draft is merged.

Changeset

Major: the public legacy generated-API artifact surface is removed and Infra moves from the historical data.apis contract to the canonical generatedApis contract.