feat(api-server,sdk,cli): implement Application API with full-stack support (#1676)

## Summary

- **API Server**: Full Application plugin (CRUD + sync/refresh/status
sub-resources) with OpenAPI spec, database migration, integration tests,
and RBAC role seeds (`gitops:admin`, `gitops:viewer`)
- **SDK**: Generated Go, Python, and TypeScript clients with
`ApplicationBuilder` and `ApplicationPatchBuilder` for type-safe
resource construction
- **CLI**: Standalone `acpctl application` command with 7 subcommands
(list/get/create/update/delete/sync/refresh) plus registration in all
generic commands (`get`, `create`, `delete`, `describe`)
- **RBAC**: `ResourceApplication` permission constants, role hierarchy
entries, scope/middleware updates for `sync`/`refresh` → `update` action
mapping

Implements the Application kind (GitOps continuous sync) from the data
model spec in #1648.

## Components Changed

 < /dev/null |  Component | Changes |
|---|---|
| `ambient-api-server` | OpenAPI spec, plugin
(model/dao/service/handler/presenter/migration), RBAC extensions,
integration tests |
| `ambient-sdk` | Generated Go/Python/TS clients and types for
Application CRUD |
| `ambient-cli` | Standalone `application` command + generic
`get`/`create`/`delete`/`describe` support |
| `workflows` | 11 lessons learned added to `ambient-model.workflow.md`
|

## Test plan

- [x] API server integration tests pass (5/5: Get, Post, Patch, Paging,
ListSearch)
- [x] API server unit tests pass (crypto, middleware, rbac)
- [x] `go build ./...` passes for api-server, cli, and go-sdk
- [x] `go vet ./...` passes for api-server and cli
- [x] No `panic()` in production code
- [x] No bare `any` types in frontend/TS code
- [x] UAT cluster deployment verified — all 8 API operations tested live
(CREATE, GET, LIST, PATCH, SYNC, REFRESH, STATUS, DELETE)
- [x] CLI `acpctl application --help` verified with all subcommands
- [x] Generic commands (`get applications`, `delete application`,
`describe application`, `create application`) all verified

🤖 Generated with [Claude Code](https://claude.ai/code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Applications API: full CRUD, list with pagination/filtering,
sync/refresh/status operations
* CLI: acpctl application commands
(list/get/create/update/delete/sync/refresh)

* **SDKs**
  * Go, Python, and TypeScript clients and models for Applications

* **Security / Roles**
  * Added GitOps roles and application-scoped RBAC permissions

* **Database**
  * Migrations to add Applications schema and seed GitOps roles

* **Tests**
  * Integration and factory tests for Applications

* **Documentation**
  * Workflow guides updated with SDK/generator and CI notes
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: user <u@example.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

components/ambient-api-server/cmd/ambient-api-server/main.go

@@ -16,6 +16,7 @@ import (
 
 	// Backend-compatible plugins only
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/agents"
+	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/applications"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/credentials"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/inbox"
 	_ "github.com/ambient-code/platform/components/ambient-api-server/plugins/projectSettings"