#580 release: chat-workflow route stub (#579)

Summary

Release of PR #579 — POST /api/chat/workflow route stub. Lands the contract from recoupable/docs#221 with body validation, full ownership/sandbox checks, and a hardcoded UIMessage stream + x-workflow-run-id: stub-<uuid> header so the chat-side team can integrate against the real contract today.

PR 2 of 5 for the open-agents → api chat-workflow port.

Verification

• ✅ Unit tests: 2900/2900 pass
• ✅ Lint clean
• ✅ E2E verified on preview deployment via Chrome DevTools MCP (real agent API key + real session/chat/sandbox → 200 + correct SSE stream + x-workflow-run-id header)
• ✅ Prod payload (with trigger, id, recoupAccessToken fields) confirmed compatible (Zod's default .strip() silently drops unknown keys)

🤖 Generated with Claude Code

---

Summary by cubic

Adds a POST /api/chat/workflow route stub that validates the request, checks session/chat ownership and sandbox state, and streams a minimal UI message with an x-workflow-run-id header. This lets chat clients integrate with the real API shape while the workflow backend is wired up.

• New Features
  • Implements POST /api/chat/workflow and OPTIONS with CORS headers.
  • Validates JSON body (messages, chatId, sessionId, optional context.contextLimit) via zod; runs auth with validateAuthContext.
  • Verifies session/chat ownership and sandbox active (Supabase lookups + isSandboxActive).
  • On success, streams a minimal UIMessage using ai and sets x-workflow-run-id: stub-<uuid>.
  • Error responses match the contract: 400 (invalid body or sandbox inactive), 401 (auth), 403 (forbidden), 404 (not found), 500 (DB error).

Summary by CodeRabbit

• New Features
  • Added /api/chat/workflow endpoint supporting streaming responses
  • Included request validation and authentication mechanisms
  • Added error handling for invalid sessions and unauthorized access