feat: join request claim secrets, onboarding API, and company branding

Add secure claim secret flow for agent join requests with timing-safe
comparison, expiry, and one-time use. Expose machine-readable onboarding
manifests and skill index API endpoints. Add company brand color with
hex validation, pattern icon generation, and settings page integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/db/src/migrations/0022_company_brand_color.sql

@@ -0,0 +1 @@
+ALTER TABLE "companies" ADD COLUMN "brand_color" text;

packages/db/src/migrations/0023_fair_lethal_legion.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "join_requests" ADD COLUMN "claim_secret_hash" text;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD COLUMN "claim_secret_expires_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "join_requests" ADD COLUMN "claim_secret_consumed_at" timestamp with time zone;

packages/db/src/migrations/meta/_journal.json

@@ -155,6 +155,20 @@
       "when": 1772122471656,
       "tag": "0021_chief_vindicator",
       "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "7",
+      "when": 1772186400000,
+      "tag": "0022_company_brand_color",
+      "breakpoints": true
+    },
+    {
+      "idx": 23,
+      "version": "7",
+      "when": 1772139727599,
+      "tag": "0023_fair_lethal_legion",
+      "breakpoints": true
     }
   ]
 }