Feat v0.3.4 team roles + multi-party validation (#18)

Custom team roles: removed CHECK constraint on team_members.role,
roles stored in teams.settings, roles API, stage_config.required_role
enforced on claim. Multi-party signoff: workflow_signoffs table,
validation gate in advanceInternal, SubmitSignoff engine method,
signoff HTTP API. Frontend: dynamic role management, stage config
validation UI, signoff panel. Design docs for extension lifecycle
and trigger composition. 20 store tests passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/models/workflow.go

@@ -504,6 +504,25 @@ type WorkflowAssignment struct {
 	CreatedAt   time.Time       `json:"created_at"`
 }
 
+// ── Workflow Signoff (v0.3.4) ───────────────
+
+// WorkflowSignoff records a user's approval or rejection at a stage boundary.
+type WorkflowSignoff struct {
+	ID         string    `json:"id"`
+	InstanceID string    `json:"instance_id"`
+	Stage      string    `json:"stage"`
+	UserID     string    `json:"user_id"`
+	Decision   string    `json:"decision"` // approve | reject
+	Comment    string    `json:"comment"`
+	CreatedAt  time.Time `json:"created_at"`
+}
+
+// Signoff decision constants.
+const (
+	SignoffApprove = "approve"
+	SignoffReject  = "reject"
+)
+
 // ── Workflow Version (immutable snapshot) ───
 
 // WorkflowVersion is an immutable snapshot of a workflow definition