fix(p0): resolve active domain automatically when onboarding skipped

- New resolveActiveDomain() helper in apps/web/lib/auth.ts: returns the
  user's first existing domain (ordered by sort_order then created_at),
  or auto-creates a default 'Personal' domain if they have none.
- 7 affected API routes (agents, canvases, domains, habits, projects,
  search, tasks) now fall back to resolveActiveDomain when the request
  omits a domain param. This eliminates the UNDEFINED_VALUE on domain_id
  and 22P02 invalid uuid errors that broke 6+ UI flows.
- New POST /api/quick-capture route: switches on type=task|habit|note|project
  to create the right entity, after resolving the active domain. This is
  the API the dashboard quick-capture widget calls.
- packages/db/src/schema.ts: added ownerId: uuid('owner_id') to the
  domains table so each user owns their domains.
- drizzle/0004_add_owner_id_to_domains.sql: matching migration with
  column add + index.
- apps/web/__tests__/lib/auth.test.ts: unit tests for both branches of
  resolveActiveDomain (returns existing / creates Personal).
- apps/web/app/(dashboard)/canvas/page.tsx: removed hardcoded
  domain: 'personal' from the quick-create payload so server-side
  resolution can do its job.

This unblocks all of: /tasks, /habits, /projects, /search, /settings/agents,
/settings/domains, /canvas, and dashboard quick-capture.

apps/web/lib/auth.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { getServerSession } from 'next-auth';
 import { authOptions } from './auth-config';
 import { db, domains } from '@project-e/db';
-import { eq } from 'drizzle-orm';
+import { asc, eq } from 'drizzle-orm';
 
 export interface AuthUser {
   id: string;
@@ -56,6 +56,34 @@ export async function requireWorkspaceAccess(workspaceId: string): Promise<void>
   }
 }
 
+/**
+ * Resolve the user's active workspace/domain. If the user has any domain,
+ * return the first one (ordered by sort_order then created_at). If they
+ * have none (onboarding skipped), auto-create a default "Personal"
+ * domain for them and return that.
+ *
+ * This is the single source of truth for "what domain is this user
+ * working in right now?" -- every ambiguous caller should route through
+ * this before touching the DB.
+ */
+export async function resolveActiveDomain(user: { id: string; email: string; name?: string | null }): Promise<{ id: string; name: string; created: boolean }> {
+  const [existing] = await db
+    .select({ id: domains.id, name: domains.name })
+    .from(domains)
+    .where(eq(domains.ownerId, user.id))
+    .orderBy(asc(domains.sortOrder), asc(domains.createdAt))
+    .limit(1);
+  if (existing) return { ...existing, created: false };
+  const slug = 'personal-' + user.id.slice(0, 8);
+  const [created] = await db.insert(domains).values({
+    ownerId: user.id,
+    name: 'Personal',
+    slug: slug,
+    sortOrder: 0,
+  }).returning({ id: domains.id, name: domains.name });
+  return { ...created, created: true };
+}
+
 /**
  * Auth middleware for API routes
  * Wraps a route handler and ensures authentication