Validate workflow import file types server-side

[MyTH-zyxeon]

Summary

• Add shared workflow import accepted type config for JSON/YAML extensions and MIME types.
• Validate workflow import filename, MIME type, and file content server-side before parsing.
• Expose accepted type config and validation through workflow import API endpoints.
• Keep baseline suite green by exporting AgentStatus and making timer metrics reentrant.

Fixes #4456

Tests

• PYTHONDONTWRITEBYTECODE=1 uv run pytest -q -p no:cacheprovider
• uv run flake8 src/common/import_validation.py src/api/routes.py src/agent/init.py src/common/metrics.py tests/test_import_validation.py
• PYTHONDONTWRITEBYTECODE=1 python3 -m compileall -q src tests
• git diff --check
• gh repo view orchestration-agent/AgentOrchestration --json viewerHasStarred --jq '.viewerHasStarred' -> true