feat: Phase 1 foundation - schema, auth, realtime, shell

- Rewrote Drizzle schema: 20 tables with enums, relations, indexes
- Generated migration with DROP TABLE records (v1 EAV removal)
- Added passkey auth routes (register/login)
- Added requireWorkspaceAccess helper
- Added seedDefaultData for Personal workspace + welcome note
- Updated SSE endpoint for v2 entities + workspace_id filtering
- Created recordActivity helper (insert + pg_notify)
- Updated sidebar: Graph replaces Reports, removed Analytics
- Updated command palette for v2 entities
- Created AGENTS.md with locked contract
- Created llm-wiki scaffold (5 stubs)
- Added inline AGENT INSTRUCTION comments to all 50 API route files
- Fixed globals.css border-border class conflict
- Updated database.ts stub for v1 compatibility

apps/web/middleware.ts

@@ -5,10 +5,11 @@ export function middleware(request: NextRequest) {
   const token = request.cookies.get('next-auth.session-token')?.value
     || request.cookies.get('__Secure-next-auth.session-token')?.value;
 
-  // If no token and trying to access protected routes, redirect to login
+  // Protected routes (v1 + v2)
   const protectedRoutes = [
     '/dashboard', '/tasks', '/habits', '/projects', '/notes', '/reports',
     '/calendar', '/analytics', '/agents', '/settings',
+    '/graph', '/domains',
   ];
   if (!token && protectedRoutes.some((route) => request.nextUrl.pathname === route || request.nextUrl.pathname.startsWith(`${route}/`))) {
     const loginUrl = new URL('/login', request.url);