v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/application/container_delivery.py

@@ -0,0 +1,29 @@
+"""Wiring for the delivery workstream (repo workspaces, delivery hooks, deploy tester).
+
+Foundation defaults are in-memory fakes. The delivery agent replaces the bodies (behind
+settings) with the real adapters; the function names and return types are FROZEN.
+"""
+
+from __future__ import annotations
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.application.ports.delivery_hooks import DeliveryHooks, NullDeliveryHooks
+from app.application.ports.deploy_target import DeployTargetTester, FakeDeployTargetTester
+from app.application.ports.repo_workspace import FakeRepoWorkspace, RepoWorkspacePort
+
+_fake_workspace = FakeRepoWorkspace()
+_null_hooks = NullDeliveryHooks()
+_fake_deploy_tester = FakeDeployTargetTester()
+
+
+def build_repo_workspace(session: AsyncSession) -> RepoWorkspacePort:
+    return _fake_workspace
+
+
+def build_delivery_hooks(session: AsyncSession) -> DeliveryHooks:
+    return _null_hooks
+
+
+def build_deploy_target_tester(session: AsyncSession) -> DeployTargetTester:
+    return _fake_deploy_tester