refactor(orpc): shared error mapping, workspace-access gate, /api-internal router

[realcodesiman]

Summary

• Consolidates the three oRPC auth-stack exports (authorizedAPI, workspaceTokenAuthAPI, channelApiTokenAPI) onto one shared instanceof-based error mapper, replacing three duplicated error.name === checks. Adds an ActionValidationError → 422 mapping.
• Wires the owner-quota/trial gate (checkWorkspaceOwnerAccess, from authorize-workspace-access.ts) into workspaceAuthorizedMidddleware so an oRPC mutation can't bypass the same gate a server action already enforces for the identical operation. Mutations only — GET/HEAD/DELETE stay open so an expired workspace keeps its read/delete-only mode (invariant [Settings] General setting page #14).
• Splits the OpenAPI REST surface: /api/[[...rest]] now serves only publicRouter (workspace-token / channel-token authed procedures) instead of the full session-authed router. A procedure missing from publicRouter now 404s instead of silently answering to a session cookie. A dev-only /api-internal mirrors the old full-router behavior for local Scalar debugging and 404s in production.
• Wires two previously-unregistered workspace-token API modules (externalWebhooksWorkspaceTokenAPIs, refLinksWorkspaceTokenAPIs) into publicRouter.

⚠️ Branch dependency

This branch is stacked on #1065 (PR-1, rename) and #1066 (PR-2, token hash) — it needs authorize-workspace-access.ts from PR-2 and the api/private.ts naming from PR-1. Merge #1065 and #1066 first, then this PR's diff against main will shrink to just its own ~550 lines. Until then the diff shown here includes their changes too.

Notes for reviewers

• Important catch during extraction: main had independently evolved orpc.ts and safe-action.ts since the source migration branch diverged — both gained SdkException/toPublicErrorMessage channel-error-message handling from an already-merged, unrelated PR. A naive copy of the migration branch's version of these two files would have silently deleted that feature. Both files were hand-merged to preserve it; orpc-error-mapping.test.ts doesn't exercise the SdkException path (it predates that feature), so I verified it manually — toKnownOrpcError still maps SdkException → BAD_REQUEST with the provider's own message.
• The builder UI is unaffected by the /api → publicRouter restriction: it calls the untouched /rpc/[[...rest]]/route.ts, which still serves the full router. /api is the external-integration/OpenAPI surface (MCP, CLI, third-party tools).
• apps/builder/__tests__/public-router-boundary.test.ts dynamically scans the filesystem for every features/**/api/workspace-token.ts and fails if any aren't wired into routers/public.ts — this is a regression guard the branch introduces, not something I hand-verified once and hoped stays true.
• Deliberately did not touch @/features/tags/api/token-auth.ts — the source branch's tags/api/workspace-token.ts replacement depends on @chatbotx.io/api-contract, a package that doesn't exist until PR-4. Renaming/rewriting it here would break the build.

Test plan

• pnpm lint — clean
• pnpm --filter builder check-types — clean
• pnpm --filter builder test — 2028/2028 passing (2020 carried over from PR-1/PR-2 + 8 new)
• pnpm check:circular — no new circular deps (69 pre-existing, unchanged)
• invariant-guard agent review — PASS (specifically verified the SdkException merge survived correctly in both files)
• Manual security review — no findings (verified /api-internal's production gate, the public/private router boundary, and that /api-internal in proxy.ts's allowlist only bypasses the middleware redirect, not per-procedure auth)