Consolidate backend: drop vendored APwhy, converge on goose + sqlc

Phase 0 cleanup verified end-to-end:

- Delete vendored APwhy runtime (cmd/apwhy, internal/apwhy) and the
  unwired copy (internal/api/server.go + static bundle + cloned
  internal/{storage,analytics,auth,rbac}) — ~7.5k lines of dead code.
- Keep Containr's native internal/gateway; move APwhy management
  routes under /api/v1/gateway/* so they stop colliding with the
  native /services paths. Fix handlers against the real schema:
  UUID ids via RETURNING, integer enabled flags, plan validation,
  service validate endpoint, unique-violation mapping.
- Port agents.go off GORM onto sqlc (sqlc/queries/agents.sql);
  drop gorm dependencies; fix sqlc schema drift (services.environment_id).
- Replace the SELECT 1 goose baseline with the real consolidated
  schema (52 tables) minus APwhy's parallel auth/RBAC objects;
  idempotent via IF NOT EXISTS / OR REPLACE / guarded DO blocks so it
  replays cleanly over legacy installs. Add a drop migration for the
  dead objects and delete the legacy filename-tracked migrations/
  loader, directory, and Dockerfile copy. Verified via cmd/migrate:
  fresh install 53 tables, legacy upgrade clean to 20260917000000.
- Canvas: add invisible React Flow handles to ServiceNode so inferred
  auto-connections stop emitting warning #008.
- Remove reactflow dep (superseded by @xyflow/react), test harness
  cmds, and legacy 0001_init.sql backups.

Authored By: TDvorak <[email protected]>

app/backend/internal/middleware/ratelimit.go

@@ -10,10 +10,10 @@ import (
 
 // RateLimiter implements a token bucket rate limiter
 type RateLimiter struct {
-	mu       sync.RWMutex
-	buckets  map[string]*bucket
-	rate     int           // requests per window
-	window   time.Duration // time window
+	mu              sync.RWMutex
+	buckets         map[string]*bucket
+	rate            int           // requests per window
+	window          time.Duration // time window
 	cleanupInterval time.Duration
 }
 
@@ -26,15 +26,15 @@ type bucket struct {
 // NewRateLimiter creates a new rate limiter
 func NewRateLimiter(rate int, window time.Duration) *RateLimiter {
 	rl := &RateLimiter{
-		buckets:  make(map[string]*bucket),
-		rate:     rate,
-		window:   window,
+		buckets:         make(map[string]*bucket),
+		rate:            rate,
+		window:          window,
 		cleanupInterval: window * 2,
 	}
-	
+
 	// Start cleanup goroutine
 	go rl.cleanup()
-	
+
 	return rl
 }
 
@@ -107,7 +107,7 @@ func RateLimit(rate int, window time.Duration) gin.HandlerFunc {
 
 		if !limiter.Allow(key) {
 			c.JSON(http.StatusTooManyRequests, gin.H{
-				"error": "rate_limit_exceeded",
+				"error":   "rate_limit_exceeded",
 				"message": "Too many requests. Please try again later.",
 			})
 			c.Abort()
@@ -125,7 +125,7 @@ func RateLimitByIP(rate int, window time.Duration) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		if !limiter.Allow(c.ClientIP()) {
 			c.JSON(http.StatusTooManyRequests, gin.H{
-				"error": "rate_limit_exceeded",
+				"error":   "rate_limit_exceeded",
 				"message": "Too many requests from your IP. Please try again later.",
 			})
 			c.Abort()
@@ -155,7 +155,7 @@ func RateLimitByUser(rate int, window time.Duration) gin.HandlerFunc {
 
 		if !limiter.Allow("user:" + uid) {
 			c.JSON(http.StatusTooManyRequests, gin.H{
-				"error": "rate_limit_exceeded",
+				"error":   "rate_limit_exceeded",
 				"message": "Too many requests. Please slow down.",
 			})
 			c.Abort()