feat(pipeline): render queue, worker service and automated preview generation

One "Queue Export" click now renders the EXR sequence, then rebuilds the shot
headlessly with the studio slate/overlay template to produce the delivery MOV
and review MP4. Implements RenderPipeline2 phases 1-2 plus the preview stage.

Server:
- New models Export, RenderJob, ExportEvent, Machine, WorkerHeartbeat, plus
  Project.deliveryConfig and per-submission slate fields (Export.vfxScope,
  Export.submissionNote, inherited from the shot's previous export).
  Both migrations are purely additive; no existing column is touched.
- lib/render-pipeline: server-enforced state machine, transactional version
  increment with supersede, atomic FOR UPDATE SKIP LOCKED claim gated by
  machine availability windows, and a lease reaper run from instrumentation.ts.
- /api/ext/* endpoints for the panel and workers; session-auth mirrors under
  /api/render and /api/machines for the web UI.
- Pipeline pages: render queue, export detail, machine monitoring, plus an
  Exports tab on shot detail.

RenderWorker (.NET 8 Windows service, new):
- Registration, heartbeat as cancel channel, claim loop, aerender runner with
  progress parsing and stall watchdog, crash recovery and disk-spooled
  reporting that survives server downtime.
- Preview stage: headless AE assembles the preview comp into a throwaway AEP
  with both output modules queued, then a single aerender pass renders them.
  Preview jobs are not claimed while an interactive AE session is open, so an
  artist's project is never taken over.

AE panel: Queue Export with live status polling, urgent flag, retry, and the
VFX Scope / Submission Note fields. Every existing panel action is unchanged.

Preview chaining ships disabled behind SystemConfig preview.enabled.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/render-pipeline/manifest.ts

@@ -0,0 +1,52 @@
+import { z } from "zod";
+
+/**
+ * The Render Manifest (RenderPipeline2 §6.2).
+ * Uploaded by the AE panel on Queue Export, snapshotted verbatim into
+ * RenderJob.manifest, handed to the worker on claim.
+ *
+ * `outputDir` / `outputPattern` may be the literal string "auto" — the server
+ * generates them from the shot's exrOutput convention and the NEW version
+ * number it decides (§6.4 E1).
+ */
+export const renderManifestSchema = z
+  .object({
+    manifestVersion: z.number().int().min(1).default(1),
+    projectCode: z.string().min(1),
+    shotCode: z.string().regex(/^[A-Za-z0-9_-]+$/, "shotCode contains invalid characters"),
+    shotId: z.string().min(1),
+    aepPath: z.string().min(1),
+    compName: z.string().min(1),
+    rendererType: z.string().default("aerender"),
+    aeVersionHint: z.string().optional(),
+    outputDir: z.string().min(1),
+    outputPattern: z.string().min(1),
+    outputModuleTemplate: z.string().optional(),
+    renderSettingsTemplate: z.string().optional(),
+    frameStart: z.number().int(),
+    frameEnd: z.number().int(),
+    fps: z.number().positive(),
+    width: z.number().int().positive(),
+    height: z.number().int().positive(),
+    expected: z
+      .object({
+        colorspace: z.string().optional(),
+        bitDepth: z.string().optional(),
+        exrCompression: z.string().optional(),
+        alpha: z.boolean().optional(),
+        timecodeStart: z.string().optional(),
+      })
+      .optional(),
+    preview: z
+      .object({
+        template: z.string().optional(),
+        burnins: z.boolean().optional(),
+      })
+      .optional(),
+  })
+  .refine((m) => m.frameEnd >= m.frameStart, {
+    message: "frameEnd must be >= frameStart",
+    path: ["frameEnd"],
+  });
+
+export type RenderManifest = z.infer<typeof renderManifestSchema>;