v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/core/config.py

@@ -127,6 +127,36 @@ class Settings(BaseSettings):
     #: 5xx responses are recorded regardless of this setting.
     error_log_client_errors: bool = False
 
+    # >>> agent-1 (org platform): add settings ONLY between these markers
+    mcp_gateway_host: str = "127.0.0.1"
+    mcp_gateway_port: int = 8765
+    mcp_token_ttl_days: int = 90
+    memory_org_char_cap: int = 60000
+    platform_invite_ttl_hours: int = 72
+    # <<< agent-1
+
+    # >>> agent-2 (AI workforce engine): add settings ONLY between these markers
+    engine_max_tool_calls_per_turn: int = 40
+    engine_turn_timeout_seconds: int = 900
+    engine_max_cycles: int = 6
+    engine_max_employees: int = 20
+    engine_tick_seconds: float = 10.0
+    # <<< agent-2
+
+    # >>> agent-3 (delivery & infra): add settings ONLY between these markers
+    sandbox_docker_bin: str = "docker"
+    sandbox_workspaces_root: str = "./.data/workspaces"
+    sandbox_default_cpus: float = 1.0
+    sandbox_default_memory_mb: int = 1024
+    demo_port_start: int = 8100
+    demo_port_end: int = 8999
+    delivery_poll_seconds: int = 60
+    deploy_allow_private_hosts: bool = False
+    artifacts_root: str = "./.data/artifacts"
+    git_workspace: str = "fake"  # fake | local
+    allow_custom_domains: bool = False
+    # <<< agent-3
+
     @property
     def cors_origin_list(self) -> list[str]:
         return [o.strip() for o in self.cors_origins.split(",") if o.strip()]