v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/plan/PLAN-v2.md

@@ -7,7 +7,7 @@ its own TODO file:
 
 | File | Agent | Area |
 |---|---|---|
-| `docs/plan/TODO-0-foundation.md` | Claude (runs FIRST, before the agents) | shared contracts, DB foundation, wiring |
+| `docs/plan/TODO-0-foundation.md` | Claude (DONE before the agents start) | shared contracts, DB foundation, wiring |
 | `docs/plan/TODO-agent-1-org-platform.md` | Agent 1 | invites, org wizard, app profile, sharing, owner model grants, memory, MCP |
 | `docs/plan/TODO-agent-2-ai-workforce.md` | Agent 2 | admin (manager) AI, employees, dynamic pipelines, agent loop, test/commit/push |
 | `docs/plan/TODO-agent-3-delivery-infra.md` | Agent 3 | docker sandbox, git workspaces, live CI/CD, demo server, Caddy domains, SSH/FTP deploy |
@@ -214,6 +214,14 @@ Log events are **batched** (at most one event per 500 ms per stream, max 200 lin
 
 `*` = new file (Claude creates an empty stub in TODO-0, the agent fills it).
 
+**Foundation-owned shared helpers (read/call only, never edit):** `app/infrastructure/db/columns.py`
+(`pk()`, `created()` for your `models_*.py` files; never import from `db/models.py` there, it causes an import
+cycle), `app/infrastructure/repositories/app_profile.py` (`AppProfileRepository`: read the app profile, or write
+it with `update_profile`; this is how Agent 1 writes and Agents 2 and 3 read build/test commands, port, healthcheck),
+`app/domain/projects/profile.py` (`AppProfile`), `app/application/ports/model_grants.py::tier_for`.
+Wiring functions are in `container_org.py` / `container_engine.py` / `container_delivery.py`: you replace **the
+body** of your own builders (names and return types are frozen); `container.py` re-exports them.
+
 **Locked files (Claude only):** `db/models.py`, `container.py`, `rpc_app.py`, `workers/__main__.py`,
 `ports/*.py` contracts, `tests/conftest.py`, `pyproject.toml`, `package.json`, `pnpm-lock.yaml`,
 `apps/web/src/lib/api.ts`, `apps/web/src/lib/nav.ts`, `components/AppShell.tsx`, `alembic/env.py`, root
@@ -222,11 +230,17 @@ Log events are **batched** (at most one event per 500 ms per stream, max 200 lin
 **Append-only blocks.** `app/core/config.py` and `.env.example` each have three marked blocks
 (`# >>> agent-1` … `# <<< agent-1`, and so on). You may add lines **only inside your own block**.
 
-Each new migration uses `down_revision = "a0f0e1d2c3b4"` (the foundation). Claude adds the merge
+Routers for every new area are already registered in `rpc_app.py` (empty stubs: `app_setup`, `memory`,
+`mcp_tokens`, `admin_grants`, `delivery`, `admin_domains`); the delivery worker is registered as `delivery` in
+`workers/__main__.py`. The admin console tab list now comes from `ADMIN_ITEMS` in `lib/nav.ts` (the layout no longer
+has its own copy). Each new migration uses `down_revision = "a0f0e1d2c3b4"` (the foundation). Claude adds the merge
 revision when the branches are merged.
 
 ## 7. Working rules for every agent
 
+0. **Environment:** the main repo is on an exFAT disk (`/projects`, no symlinks, so no venv/node_modules there).
+   Your worktree lives on ext4 under `/home/mamad/work/smart-org-wt/<agent>` with `.venv` and `node_modules` already
+   installed. Use `pnpm` (in `~/.local/bin`) and `apps/api/.venv/bin/python`. Python is 3.13 via `uv`.
 1. Work **only** in your own git worktree and branch (given in your TODO file). Never `cd` outside it and
    never write to `/tmp`. Put scratch scripts in `./_scratch/` inside your worktree and delete them at the end.
 2. **Do NOT commit, push, merge or rebase.** Claude reviews and commits each phase.