feat: add Google OAuth, remote worker system, and file browser

- Google OAuth login with JWT session cookies, per-user project isolation
- Remote worker registration via WebSocket, execute_on_worker/list_workers agent tools
- File browser UI in workflow view, file upload/download API
- Deploy script switched to local build, added tori.euphon.cloud ingress

src/db.rs

@@ -73,6 +73,13 @@ impl Database {
         .execute(&self.pool)
         .await;
 
+        // Migration: add owner_id column to projects
+        let _ = sqlx::query(
+            "ALTER TABLE projects ADD COLUMN owner_id TEXT NOT NULL DEFAULT ''"
+        )
+        .execute(&self.pool)
+        .await;
+
         // KB tables
         sqlx::query(
             "CREATE TABLE IF NOT EXISTS kb_articles (
@@ -215,6 +222,19 @@ impl Database {
         .execute(&self.pool)
         .await?;
 
+        sqlx::query(
+            "CREATE TABLE IF NOT EXISTS users (
+                id TEXT PRIMARY KEY,
+                email TEXT NOT NULL UNIQUE,
+                name TEXT NOT NULL DEFAULT '',
+                picture TEXT NOT NULL DEFAULT '',
+                created_at TEXT NOT NULL DEFAULT (datetime('now')),
+                last_login_at TEXT NOT NULL DEFAULT (datetime('now'))
+            )"
+        )
+        .execute(&self.pool)
+        .await?;
+
         sqlx::query(
             "CREATE TABLE IF NOT EXISTS step_artifacts (
                 id TEXT PRIMARY KEY,
@@ -242,6 +262,8 @@ pub struct Project {
     pub updated_at: String,
     #[serde(default)]
     pub deleted: bool,
+    #[serde(default)]
+    pub owner_id: String,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]