Consolidate backend: drop vendored APwhy, converge on goose + sqlc

Phase 0 cleanup verified end-to-end:

- Delete vendored APwhy runtime (cmd/apwhy, internal/apwhy) and the
  unwired copy (internal/api/server.go + static bundle + cloned
  internal/{storage,analytics,auth,rbac}) — ~7.5k lines of dead code.
- Keep Containr's native internal/gateway; move APwhy management
  routes under /api/v1/gateway/* so they stop colliding with the
  native /services paths. Fix handlers against the real schema:
  UUID ids via RETURNING, integer enabled flags, plan validation,
  service validate endpoint, unique-violation mapping.
- Port agents.go off GORM onto sqlc (sqlc/queries/agents.sql);
  drop gorm dependencies; fix sqlc schema drift (services.environment_id).
- Replace the SELECT 1 goose baseline with the real consolidated
  schema (52 tables) minus APwhy's parallel auth/RBAC objects;
  idempotent via IF NOT EXISTS / OR REPLACE / guarded DO blocks so it
  replays cleanly over legacy installs. Add a drop migration for the
  dead objects and delete the legacy filename-tracked migrations/
  loader, directory, and Dockerfile copy. Verified via cmd/migrate:
  fresh install 53 tables, legacy upgrade clean to 20260917000000.
- Canvas: add invisible React Flow handles to ServiceNode so inferred
  auto-connections stop emitting warning #008.
- Remove reactflow dep (superseded by @xyflow/react), test harness
  cmds, and legacy 0001_init.sql backups.

Authored By: TDvorak <[email protected]>

app/backend/internal/database/migrations.go

@@ -1,73 +1,10 @@
 package database
 
 import (
-	"context"
 	"fmt"
 	"log"
-	"os"
-	"path/filepath"
-	"regexp"
-	"sort"
 )
 
-var managedMigrationPattern = regexp.MustCompile(`^\d{3}_.+\.sql$`)
-
-// Migrate runs all migration files in the migrations directory
-func (db *DB) Migrate(migrationsDir string) error {
-	if err := db.ensureRequiredExtensions(); err != nil {
-		return err
-	}
-
-	// Create migrations table if it doesn't exist
-	if err := db.createMigrationsTable(); err != nil {
-		return fmt.Errorf("failed to create migrations table: %w", err)
-	}
-
-	migrationFiles, err := listManagedMigrationFiles(migrationsDir)
-	if err != nil {
-		return err
-	}
-
-	// Run each migration that hasn't been run yet
-	for _, fileName := range migrationFiles {
-		if err := db.runMigration(migrationsDir, fileName); err != nil {
-			return fmt.Errorf("failed to run migration %s: %w", fileName, err)
-		}
-	}
-
-	log.Println("All migrations completed successfully")
-	return nil
-}
-
-func listManagedMigrationFiles(migrationsDir string) ([]string, error) {
-	entries, err := os.ReadDir(migrationsDir)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read migrations directory: %w", err)
-	}
-
-	migrationFiles := make([]string, 0, len(entries))
-	for _, entry := range entries {
-		if entry.IsDir() {
-			continue
-		}
-
-		fileName := entry.Name()
-		if !isManagedMigrationFile(fileName) {
-			log.Printf("Skipping unmanaged migration file: %s", fileName)
-			continue
-		}
-
-		migrationFiles = append(migrationFiles, fileName)
-	}
-
-	sort.Strings(migrationFiles)
-	return migrationFiles, nil
-}
-
-func isManagedMigrationFile(fileName string) bool {
-	return managedMigrationPattern.MatchString(fileName)
-}
-
 func (db *DB) ensureRequiredExtensions() error {
 	if _, err := db.Exec(`CREATE EXTENSION IF NOT EXISTS pgcrypto`); err != nil {
 		return fmt.Errorf("failed to ensure pgcrypto extension required for UUID defaults: %w", err)
@@ -75,66 +12,6 @@ func (db *DB) ensureRequiredExtensions() error {
 	return nil
 }
 
-func (db *DB) createMigrationsTable() error {
-	query := `
-		CREATE TABLE IF NOT EXISTS migrations (
-			id SERIAL PRIMARY KEY,
-			filename VARCHAR(255) UNIQUE NOT NULL,
-			executed_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-		)
-	`
-	_, err := db.Exec(query)
-	return err
-}
-
-func (db *DB) runMigration(migrationsDir, fileName string) error {
-	// Check if migration has already been run
-	var count int
-	err := db.QueryRow("SELECT COUNT(*) FROM migrations WHERE filename = $1", fileName).Scan(&count)
-	if err != nil {
-		return fmt.Errorf("failed to check migration status: %w", err)
-	}
-
-	if count > 0 {
-		log.Printf("Migration %s already executed, skipping", fileName)
-		return nil
-	}
-
-	// Read migration file
-	filePath := filepath.Join(migrationsDir, fileName)
-	content, err := os.ReadFile(filePath)
-	if err != nil {
-		return fmt.Errorf("failed to read migration file %s: %w", fileName, err)
-	}
-
-	// Execute migration in a transaction
-	tx, err := db.BeginTx(context.Background(), nil)
-	if err != nil {
-		return fmt.Errorf("failed to begin transaction: %w", err)
-	}
-	defer tx.Rollback()
-
-	// Execute migration SQL
-	_, err = tx.Exec(string(content))
-	if err != nil {
-		return fmt.Errorf("failed to execute migration %s: %w", fileName, err)
-	}
-
-	// Record that migration was executed
-	_, err = tx.Exec("INSERT INTO migrations (filename) VALUES ($1)", fileName)
-	if err != nil {
-		return fmt.Errorf("failed to record migration %s: %w", fileName, err)
-	}
-
-	// Commit transaction
-	if err = tx.Commit(); err != nil {
-		return fmt.Errorf("failed to commit migration %s: %w", fileName, err)
-	}
-
-	log.Printf("Successfully executed migration: %s", fileName)
-	return nil
-}
-
 // SeedData inserts initial data for development
 func (db *DB) SeedData() error {
 	// Check if we already have users