[P1][Post-0.5][Full C] Add node health, capacity, deterministic placement, and atomic reservations

[mightnent]

Parent epic: #82

Outcome

Add authenticated node health and measured capacity observations, then place new workspaces deterministically onto eligible shared, dedicated, or operator-pinned nodes using atomic capacity reservations.

Execution

• Priority: P1 post-0.5 Full C scheduling.
• Deployment profiles: Hosted required; customer-managed single-node behavior remains compatible.
• Worktree boundary: Heartbeat protocol, observed health/capacity, placement policy, reservations, tenant defaults, concurrency tests, and focused operator read models. Avoid infrastructure creation, node replacement, and storage migration.

Scope

• Record authenticated last-seen time, software/image compatibility, lifecycle readiness, and measured allocatable/used CPU, memory, disk, and workspace slots.
• Keep operator admission state separate from observed health.
• Derive healthy, degraded, stale, and offline states using explicit thresholds.
• Implement personal/shared, organization/shared, organization/dedicated, and operator-pinned placement policy.
• Enforce dedicated-node exclusivity in the database under concurrency.
• Reserve capacity transactionally before workspace creation and safely release or reconcile failed reservations.
• Leave existing workspaces pinned to their persisted owner when a tenant default changes.

Non-goals

• Automatic cloud provisioning.
• Silent failover or recreation of a stateful workspace on another node.
• Drain, replacement, storage transfer, or live migration.

Definition of success

• Stale, offline, incompatible, draining, disabled, or insufficient-capacity nodes receive no new workspace.
• Personal/shared, organization/shared, organization/dedicated, and operator-pinned placement is deterministic and tenant-safe.
• Concurrent placement proves atomic reservations, dedicated-node exclusivity, and no oversubscription.
• Failed and abandoned reservations reconcile without leaking capacity or moving an existing workspace.
• Every later lifecycle and purge call continues to use the persisted workspace owner rather than the tenant default.
• Focused store/controller/router concurrency tests, npm run verify:db, and npm run verify:quick pass on the exact candidate SHA.