feat: join request claim secrets, onboarding API, and company branding

Add secure claim secret flow for agent join requests with timing-safe
comparison, expiry, and one-time use. Expose machine-readable onboarding
manifests and skill index API endpoints. Add company brand color with
hex validation, pattern icon generation, and settings page integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/db/src/migrations/0022_company_brand_color.sql

@@ -0,0 +1 @@
+ALTER TABLE "companies" ADD COLUMN "brand_color" text;

packages/db/src/migrations/0023_fair_lethal_legion.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "join_requests" ADD COLUMN "claim_secret_hash" text;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD COLUMN "claim_secret_expires_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD COLUMN "claim_secret_consumed_at" timestamp with time zone;

packages/db/src/migrations/meta/_journal.json

@@ -155,6 +155,20 @@
       "when": 1772122471656,
       "tag": "0021_chief_vindicator",
       "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "7",
+      "when": 1772186400000,
+      "tag": "0022_company_brand_color",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1772139727599,
+      "tag": "0023_fair_lethal_legion",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/companies.ts

@@ -14,6 +14,7 @@ export const companies = pgTable(
     requireBoardApprovalForNewAgents: boolean("require_board_approval_for_new_agents")
       .notNull()
       .default(true),
+    brandColor: text("brand_color"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
   },

packages/db/src/schema/join_requests.ts

@@ -18,6 +18,9 @@ export const joinRequests = pgTable(
     adapterType: text("adapter_type"),
     capabilities: text("capabilities"),
     agentDefaultsPayload: jsonb("agent_defaults_payload").$type<Record<string, unknown> | null>(),
+    claimSecretHash: text("claim_secret_hash"),
+    claimSecretExpiresAt: timestamp("claim_secret_expires_at", { withTimezone: true }),
+    claimSecretConsumedAt: timestamp("claim_secret_consumed_at", { withTimezone: true }),
     createdAgentId: uuid("created_agent_id").references(() => agents.id),
     approvedByUserId: text("approved_by_user_id"),
     approvedAt: timestamp("approved_at", { withTimezone: true }),