feat(pipeline): render queue, worker service and automated preview generation

One "Queue Export" click now renders the EXR sequence, then rebuilds the shot
headlessly with the studio slate/overlay template to produce the delivery MOV
and review MP4. Implements RenderPipeline2 phases 1-2 plus the preview stage.

Server:
- New models Export, RenderJob, ExportEvent, Machine, WorkerHeartbeat, plus
  Project.deliveryConfig and per-submission slate fields (Export.vfxScope,
  Export.submissionNote, inherited from the shot's previous export).
  Both migrations are purely additive; no existing column is touched.
- lib/render-pipeline: server-enforced state machine, transactional version
  increment with supersede, atomic FOR UPDATE SKIP LOCKED claim gated by
  machine availability windows, and a lease reaper run from instrumentation.ts.
- /api/ext/* endpoints for the panel and workers; session-auth mirrors under
  /api/render and /api/machines for the web UI.
- Pipeline pages: render queue, export detail, machine monitoring, plus an
  Exports tab on shot detail.

RenderWorker (.NET 8 Windows service, new):
- Registration, heartbeat as cancel channel, claim loop, aerender runner with
  progress parsing and stall watchdog, crash recovery and disk-spooled
  reporting that survives server downtime.
- Preview stage: headless AE assembles the preview comp into a throwaway AEP
  with both output modules queued, then a single aerender pass renders them.
  Preview jobs are not claimed while an interactive AE session is open, so an
  artist's project is never taken over.

AE panel: Queue Export with live status polling, urgent flag, retry, and the
VFX Scope / Submission Note fields. Every existing panel action is unchanged.

Preview chaining ships disabled behind SystemConfig preview.enabled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

RenderWorker/VFXReviewWorker/AeSession.cs

@@ -0,0 +1,33 @@
+using System.Diagnostics;
+
+namespace VFXReviewWorker;
+
+/// <summary>
+/// Detects an *interactive* After Effects session on this machine.
+///
+/// This matters because `AfterFX.com -noui -r script.jsx` is handed to an
+/// already-running After Effects instance rather than starting an isolated
+/// one — so running the preview build while an artist has AE open would take
+/// over their session and quit it, losing unsaved work.
+///
+/// Deliberately conservative: this matches any After Effects process, the
+/// interactive `AfterFX.exe` as well as the `AfterFX.com` render engine that
+/// aerender drives. Waiting for either to finish also avoids two AE instances
+/// competing for the same box, and the worst case is only that a preview build
+/// starts a little later.
+/// </summary>
+public static class AeSession
+{
+    public static bool InteractiveRunning()
+    {
+        try
+        {
+            return Process.GetProcessesByName("AfterFX").Length > 0;
+        }
+        catch
+        {
+            // If we cannot tell, assume an artist is working — never risk their session.
+            return true;
+        }
+    }
+}