Consolidate backend: drop vendored APwhy, converge on goose + sqlc

Phase 0 cleanup verified end-to-end:

- Delete vendored APwhy runtime (cmd/apwhy, internal/apwhy) and the
  unwired copy (internal/api/server.go + static bundle + cloned
  internal/{storage,analytics,auth,rbac}) — ~7.5k lines of dead code.
- Keep Containr's native internal/gateway; move APwhy management
  routes under /api/v1/gateway/* so they stop colliding with the
  native /services paths. Fix handlers against the real schema:
  UUID ids via RETURNING, integer enabled flags, plan validation,
  service validate endpoint, unique-violation mapping.
- Port agents.go off GORM onto sqlc (sqlc/queries/agents.sql);
  drop gorm dependencies; fix sqlc schema drift (services.environment_id).
- Replace the SELECT 1 goose baseline with the real consolidated
  schema (52 tables) minus APwhy's parallel auth/RBAC objects;
  idempotent via IF NOT EXISTS / OR REPLACE / guarded DO blocks so it
  replays cleanly over legacy installs. Add a drop migration for the
  dead objects and delete the legacy filename-tracked migrations/
  loader, directory, and Dockerfile copy. Verified via cmd/migrate:
  fresh install 53 tables, legacy upgrade clean to 20260917000000.
- Canvas: add invisible React Flow handles to ServiceNode so inferred
  auto-connections stop emitting warning #008.
- Remove reactflow dep (superseded by @xyflow/react), test harness
  cmds, and legacy 0001_init.sql backups.

Authored By: TDvorak <[email protected]>

app/backend/internal/database/goose_migrations.go

@@ -11,27 +11,23 @@ import (
 )
 
 const (
-	defaultLegacyMigrationsDir = "migrations"
-	defaultGooseMigrationsDir  = "migrations_goose"
-	migrationAdvisoryLockKey   = int64(637266846588921720)
+	defaultGooseMigrationsDir = "migrations_goose"
+	migrationAdvisoryLockKey  = int64(637266846588921720)
 )
 
 var migrationLockRetryInterval = 250 * time.Millisecond
 
-// MigrateAll runs legacy app migrations first, then goose-managed migrations.
-// This allows a safe transition without breaking existing installations.
-func (db *DB) MigrateAll(legacyDir, gooseDir string) error {
+// MigrateAll runs the goose-managed migrations. goose is the only migration
+// path; the legacy filename-tracked system was consolidated into the baseline.
+func (db *DB) MigrateAll(gooseDir string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
 	defer cancel()
-	return db.MigrateAllWithLock(ctx, legacyDir, gooseDir)
+	return db.MigrateAllWithLock(ctx, gooseDir)
 }
 
-// MigrateAllWithLock runs legacy + goose migrations while holding a PostgreSQL
+// MigrateAllWithLock runs goose migrations while holding a PostgreSQL
 // advisory lock to prevent concurrent migrators from racing.
-func (db *DB) MigrateAllWithLock(ctx context.Context, legacyDir, gooseDir string) error {
-	if legacyDir == "" {
-		legacyDir = defaultLegacyMigrationsDir
-	}
+func (db *DB) MigrateAllWithLock(ctx context.Context, gooseDir string) error {
 	if gooseDir == "" {
 		gooseDir = defaultGooseMigrationsDir
 	}
@@ -46,15 +42,7 @@ func (db *DB) MigrateAllWithLock(ctx context.Context, legacyDir, gooseDir string
 		}
 	}()
 
-	if err := db.Migrate(legacyDir); err != nil {
-		return err
-	}
-
-	if err := db.MigrateGoose(gooseDir); err != nil {
-		return err
-	}
-
-	return nil
+	return db.MigrateGoose(gooseDir)
 }
 
 func (db *DB) acquireMigrationLock(ctx context.Context) (func() error, error) {
@@ -112,6 +100,10 @@ func (db *DB) MigrateGoose(migrationsDir string) error {
 		return fmt.Errorf("failed to access goose migrations directory %q: %w", migrationsDir, err)
 	}
 
+	if err := db.ensureRequiredExtensions(); err != nil {
+		return err
+	}
+
 	if err := goose.SetDialect("postgres"); err != nil {
 		return fmt.Errorf("failed to set goose dialect: %w", err)
 	}