Feat v0.7.6 code hygiene + test coverage

Clean up channels-era dead code, align migrations, add 92 tests,
and fix backup download + admin storage tab bugs before v0.8.x
kernel expansion.

Critical fixes:
- Remove `channels` from allowedViews in db_module.go
- Fix 5 dead API routes in workflow.html → public workflow API
- Fix RenderWorkflow handler to use route param as entry token

Dead code removal:
- Delete SeedTestChannel(), RunContext.ChannelID, webhook.ChannelID
- Fix stale comments in storage.go, prometheus.go, workflow_module.go

Migration hygiene:
- Add SQLite placeholder 013_cluster_registry.sql, renumber to 014
- Compat rename in migrate.go for existing SQLite databases
- Document missing migration 008 in both 009 files

Test coverage:
- 82 workflow routing tests (all operators, branch rules, stage resolution)
- 10 middleware tests (permissions, admin, rate limiter)

Bug fixes:
- Remove dead Admin Storage tab from System category
- Fix backup download: sw.auth.token() → sw.auth._getToken()

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/sandbox/db_module.go

@@ -15,8 +15,8 @@
 //	rows  = db.view("users", filters={"id": "abc"})
 //
 // All table access is scoped to ext_{package_id}_{table_name}.
-// Platform views (ext_view_users, ext_view_channels) are accessible
-// via db.view() and are read-only regardless of permission level.
+// Platform views (ext_view_users) are accessible via db.view()
+// and are read-only regardless of permission level.
 //
 // Queries are parameterized — no raw SQL is ever accepted from scripts.
 // Dialect differences (placeholder style) are handled internally.
@@ -44,8 +44,7 @@ type DBModuleConfig struct {
 
 // allowedViews is the set of platform views extensions may query via db.view().
 var allowedViews = map[string]bool{
-	"users":    true,
-	"channels": true,
+	"users": true,
 }
 
 // BuildDBModule creates the "db" starlark module for an extension.
@@ -435,7 +434,7 @@ func dbView(ctx context.Context, cfg DBModuleConfig) func(*starlark.Thread, *sta
 		}
 
 		if !allowedViews[viewName] {
-			return nil, fmt.Errorf("db.view: unknown view %q (allowed: users, channels)", viewName)
+			return nil, fmt.Errorf("db.view: unknown view %q (allowed: users)", viewName)
 		}
 
 		physView := "ext_view_" + viewName

server/sandbox/runner.go

@@ -61,9 +61,6 @@ type RunContext struct {
 	// UserID is the acting user for provider resolution (BYOK chain).
 	UserID string
 
-	// ChannelID is the context identifier, if any.
-	ChannelID string
-
 	// TeamID is the team context for settings cascade resolution.
 	// When set, team-scoped package settings are included in the cascade.
 	TeamID string

server/sandbox/workflow_module.go

@@ -187,4 +187,4 @@ func goValToStarlark(v interface{}) starlark.Value {
 }
 
 // workflowRoute routes the workflow to a named stage.
-// Starlark: workflow.route(channel_id, target_stage, reason)
+// Starlark: workflow.route(instance_id, target_stage, reason)