feat(apps): Rowboat Apps M1 — per-app origins, Host API core, apps skill

Implements M1 of the Apps V1 spec, replacing the mini-apps prototype:

- rowboat-app.json manifest + AppSummary/install/publish/registry schemas;
  sourceApp on background tasks
- apps server on 127.0.0.1:3210 (absorbs local-sites): Host-header routing to
  <slug>.apps.localhost origins, 421 rebinding guard, static from dist/ with
  entry/SPA fallback + realpath confinement, control host /health, chokidar
  watcher + per-app SSE with dist/data areas, embed-opt-in autosize bootstrap
  and cancelable rowboat:data-change event
- Host API: D17 anti-CSRF (X-Rowboat-App + strict Origin on non-GET),
  GET /_rowboat/app (manifest + theme), /_rowboat/events, data API under
  data/ with atomic writes and dataContracts enforcement
- indexer: list (ok/invalid surfaced) / create scaffold / delete
- IPC: apps:list/get/create/delete/setTheme; renderer reports theme live
- renderer: Apps home (My apps grid + catalog placeholder, server banner,
  invalid/kind badges) and full-height app view on the app origin
- apps copilot skill (replaces build-mini-app); app-set-data builtin replaces
  mini-app-install/set-data; deleted the app://miniapp protocol, postMessage
  bridge, mini-apps handler/channels, and local-sites

apps/x/packages/shared/src/background-task.ts

@@ -33,6 +33,9 @@ export type BackgroundTask = {
     projectId?: string;
     model?: string;
     provider?: string;
+    // Folder slug of the Rowboat App that installed this task (spec §8.2).
+    // Runtime-managed; tasks with sourceApp are owned by the app lifecycle.
+    sourceApp?: string;
     createdAt: string;
     // Runtime-managed — never hand-write. Mirrors live-note's flat-field
     // pattern: `lastAttemptAt` is bumped at every run start (backoff anchor),
@@ -53,6 +56,7 @@ export type BackgroundTaskSummary = {
     active: boolean;
     triggers?: Triggers;
     projectId?: string;
+    sourceApp?: string;
     createdAt: string;
     lastAttemptAt?: string;
     lastRunId?: string;
@@ -71,6 +75,7 @@ export const BackgroundTaskSchema = z.object({
     projectId: z.string().optional().describe('When set, marks this as a coding task pinned to a registered code project (repo). The agent implements detected work via the launch-code-task tool, each launch in its own isolated worktree.'),
     model: z.string().optional().describe('ADVANCED — leave unset. Per-task model override.'),
     provider: z.string().optional().describe('ADVANCED — leave unset. Per-task provider name override.'),
+    sourceApp: z.string().optional().describe('Folder slug of the app that installed this task. Runtime-managed.'),
     createdAt: z.string().describe('ISO timestamp set once at create-time.'),
     lastAttemptAt: z.string().optional().describe('Runtime-managed — never write this yourself. Bumped at the start of every agent run; used by the scheduler for backoff so failures do not retry-storm.'),
     lastRunId: z.string().optional().describe('Runtime-managed — never write this yourself. The id of the most recent run (success or failure); used by the bg-task:stop handler.'),
@@ -86,6 +91,7 @@ export const BackgroundTaskSummarySchema = z.object({
     active: z.boolean(),
     triggers: TriggersSchema.optional(),
     projectId: z.string().optional(),
+    sourceApp: z.string().optional(),
     createdAt: z.string(),
     lastAttemptAt: z.string().optional(),
     lastRunId: z.string().optional(),