Switch database IDs from TEXT to native UUID

Consolidate 16 migrations into one with UUID columns for all entity
IDs. TEXT is kept only for polymorphic fields (audit_logs.actor_id,
resource_id) and template names. The id package now generates UUIDs
via google/uuid, with Format*/Parse* helpers for the prefixed wire
format (sb-{uuid}, usr-{uuid}, etc.). Auth context, services, and
handlers pass pgtype.UUID internally; conversion to/from prefixed
strings happens at API and RPC boundaries. Adds PlatformTeamID
(all-zeros UUID) for shared resources.

internal/api/middleware_hosttoken.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"git.omukk.dev/wrenn/sandbox/internal/auth"
+	"git.omukk.dev/wrenn/sandbox/internal/id"
 )
 
 // requireHostToken validates the X-Host-Token header containing a host JWT,
@@ -23,7 +24,13 @@ func requireHostToken(secret []byte) func(http.Handler) http.Handler {
 				return
 			}
 
-			ctx := auth.WithHostContext(r.Context(), auth.HostContext{HostID: claims.HostID})
+			hostID, err := id.ParseHostID(claims.HostID)
+			if err != nil {
+				writeError(w, http.StatusUnauthorized, "unauthorized", "invalid host ID in token")
+				return
+			}
+
+			ctx := auth.WithHostContext(r.Context(), auth.HostContext{HostID: hostID})
 			next.ServeHTTP(w, r.WithContext(ctx))
 		})
 	}