feat(deploy): app worker backend management with MCP + skill

[Chat2DB-Pro]

Summary

Adds a control-plane management layer for deployed app workers (Cloudflare full-app workers — server module + bundled assets on a shared Workers-for-Platforms dispatch namespace). Previously the feature only had a deploy endpoint; you could ship an app worker but not list, inspect, or undeploy one. This PR closes that loop and wires it through MCP and the nubase skill.

What's included

Backend (control plane)

• AppWorkerDeployer gains 404-tolerant get / delete; CloudflareAppWorkerDeployer implements them via dispatch-namespace GET / DELETE (get → exists=false when absent, delete → idempotent). executeCloudflare refactored with an allowNotFound variant.
• New AppWorkerService does tenant-scoped list / get / delete.
• AppDeploymentAdminController (@RequireServiceRole) adds GET /deployments/admin/v1/app-workers, GET .../{workerName}, DELETE .../{workerName}.

MCP

• DeploymentsMcpTools: appWorkersList (read), appWorkerStatus (read, with live provider state), appWorkerDelete (write, gated on service_role).
• Frontend bridge: app_workers_list / app_worker_status / app_worker_delete in tools.ts + nubase-client.ts.

Skill

• New references/app-workers.md, linked from SKILL.md (reference list + read/write tool inventories).

Tenant safety

The dispatch namespace is shared across all tenants, so management never enumerates the namespace — ownership is derived solely from the project's own app_deployments history (manifest_summary.type == "app_worker", latest per workerName, case-insensitive). requireOwned() rejects any worker not owned by the calling project, so a project can never read or delete another tenant's worker. Deletes write an app_worker_delete audit row.

Additionally, the deploy path now rejects a custom workerName that isn't namespaced under the project: it must equal appCode or start with appCode- (403 otherwise), closing a pre-existing cross-tenant naming-collision gap at the deploy boundary.

Tests

• New AppWorkerServiceTest (ownership scoping + list/get/delete), extended CloudflareAppWorkerDeployerTest (get/delete + 404 cases), extended AppWorkerDeployServiceTest (workerName prefix accept/reject), appWorkerDelete service-role parity in RemoteAdminMcpToolsTest, updated McpConfigTest constructor.
• Java: mvn -o test on the affected classes → all green. Frontend: tsc build clean + node --test → 118 passed (incl. new app-worker tool dispatch test).

🤖 Generated with Claude Code