feat(server): drop primary_brand_domain column (#4159 Stage 2)

[bokelley]

Summary

Stage 2 of #4159 — drop member_profiles.primary_brand_domain entirely. After Stage 1 routed every read through getBrandPrimaryDomain (resolver-first, column-fallback), this PR cuts the column.

organization_domains.is_primary=true is now the single source of truth for both org-membership inference and brand identity. One row, one write, no more drift between the four overlapping domain columns that started this issue.

What's removed

• member_profiles.primary_brand_domain column (migration 472)
• resolver fallback to member_profiles — getBrandPrimaryDomain now reads only organization_domains.is_primary
• WorkOS-webhook auto-populate that wrote member_profiles.primary_brand_domain on first verified domain (the auto-promote-to-is_primary on organization_domains covers the same ground in one row)
• brand-identity service's dual-write to member_profiles
• /api/me/agents POST backfill that set primary_brand_domain from agent hostnames
• bootstrap endpoint's acceptance of primary_brand_domain in the request body (silently ignored — value derived from organization_domains.is_primary)
• Stage 0 data-cleanup and backfill scripts (one-shot work complete)

What's added

• 400 domain_not_workos_verified response on PUT /api/me/organization/domains/:domain/primary for non-WorkOS sources. With is_primary now driving brand identity too, an admin-imported "verified" row shouldn't be promotable via member self-service — that would let an admin escalate brand identity by importing a row.

API compat

The response field primary_brand_domain on GET /api/me/member-profile is preserved; its value is now derived from the resolver rather than stored on the profile. HTML clients (member-profile.html, dashboard-agents.html) keep working.

Test plan

• Typecheck clean
• Unit tests pass (member-profile-bootstrap-skip-rule, listing-autopublish updated for INSERT param shift)
• Integration tests — brand-domain-resolver, workos-domain-auto-primary, me-organization-domains, brand-orphan-adoption, agent-visibility-e2e, member-agents-api, member-profile-bootstrap, registry-reader-baseline-public-endpoints all updated to seed organization_domains.is_primary=true instead of writing the dropped column
• Migration 472 runs cleanly on prod
• Smoke /api/me/member-profile returns primary_brand_domain derived from the resolver

🤖 Generated with Claude Code