Feat v0.3.3 public entry + background jobs

Public workflow entry: unauthenticated routes at /api/v1/public/workflows/
for anonymous workflow participation. StartPublic creates instances with
public:<uuid> identity, ResumePublic/AdvancePublic use entry tokens.
Audience-gated: only public stages can be advanced anonymously.

SLA scanner: background goroutine (5-min interval) checks active instances
against per-stage sla_seconds. Fires workflow.sla_breach event on first
breach, marks sla_breached in instance metadata (idempotent).

Staleness sweep: new staleness_timeout_hours column on workflows. Scanner
marks idle instances as stale, cancels open assignments, fires
workflow.stale event.

New store methods: ListActiveInstances, MarkInstanceStale.
New events: workflow.sla_breach, workflow.stale.
3 new store tests (17 total), all passing on SQLite.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/database/migrations/sqlite/007_workflows.sql

@@ -20,6 +20,7 @@ CREATE TABLE IF NOT EXISTS workflows (
     retention    TEXT NOT NULL DEFAULT '{"mode": "archive"}',
     webhook_url    TEXT,
     webhook_secret TEXT,
+    staleness_timeout_hours INTEGER,
     created_by   TEXT NOT NULL REFERENCES users(id),
     created_at   TEXT NOT NULL DEFAULT (datetime('now')),
     updated_at   TEXT NOT NULL DEFAULT (datetime('now'))