fix(server): harden multi-workflow mode wiring based on review feedback

[Copilot]

Four issues in the multi-workflow mode implementation identified in review: engine manager not connected to API deploy/stop endpoints, no JWT secret length enforcement, shutdown defer using unbounded context.Background(), and admin bootstrap treating all GetByEmail errors as "user not found".

Changes

Wire engine manager to Deploy/Stop endpoints (api/)

• Added WorkflowOrchestrator interface (DeployWorkflow, StopWorkflow) satisfied by *workflow.WorkflowEngineManager
• Added Orchestrator WorkflowOrchestrator field to api.Config; wired into WorkflowHandler via NewRouterWithIAM
• Deploy/Stop handlers now call the orchestrator to start/stop live engines when set, then re-fetch from DB for the response; fall back to DB-only update when no orchestrator is wired

// api/workflow_handler.go
if h.orchestrator != nil {
    if oErr := h.orchestrator.DeployWorkflow(r.Context(), id); oErr != nil {
        WriteError(w, http.StatusInternalServerError, oErr.Error())
        return
    }
    wf, err = h.workflows.Get(r.Context(), id) // re-fetch updated status
    ...
}

JWT secret length guard (cmd/server/main.go)

• log.Fatalf when --jwt-secret < 32 bytes, consistent with the minimum enforced by module/jwt_auth.go

Bounded shutdown context

• Replaced context.Background() in the shutdown defer with context.WithTimeout(..., 10s)

Admin bootstrap error discrimination

• Replaced "any GetByEmail error → attempt create" with an explicit errors.Is(lookupErr, evstore.ErrNotFound) check; other errors (DB failures, permission issues) now log.Fatalf instead of triggering a spurious create
• Restructured as a switch to satisfy gocritic ifElseChain

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.