manifest, thin proxy router, and the sidecar backend

ported from the standalone officer-atelier service: providers (adapter-shaped, openai the only
adapter today), the generation queue, collections, and the database layer — kept on its own
Postgres database rather than folded into officer_db, since both collections and provider_settings
had rows on the machine this was extracted from.

what changed rather than just moved:
- images are served from an authenticated GET /files/:filename instead of an unauthenticated
  PUBLIC_URL-prefixed static route
- the OpenAI-key bootstrap fallback reads the secret store (getSecret) before .env, per-adapter
- provider_settings (the one-row-per-adapter shape providers replaced) did not come along — it has
  no callers left anywhere in the server code, only a migration script that also did not move

ping/echo (smoke-test routes with no caller) did not move either; the sidecar's own /_health covers
liveness.

not yet wired into the platform: sidecar/index.ts exists but nothing mounts it, and web/ has not
been written, so this is not yet a discoverable plugin.

api/router.ts

@@ -0,0 +1,21 @@
+import { createSidecarProxy } from '@@/sidecar/create-proxy';
+import { mountPrefix } from '@@/plugins/manifest';
+import { manifest } from '../manifest';
+
+// /api/atelier/* — auth, then forward to officer-atelier. No routes of its own and no Atelier
+// knowledge: this file must never grow app logic. See plugins/offscale/api/router.ts, the pattern
+// this follows.
+//
+// Generation can run for tens of seconds and the queue can be mid-flight when a caller polls, so the
+// proxy is given a longer idle timeout than the default — the sidecar itself already bounds a single
+// poll at MAX_WAIT_SECONDS (sidecar/api/images.ts), this only has to outlast that plus network slack.
+const proxy = createSidecarProxy({
+  name: 'atelier',
+  prefix: `/api${mountPrefix({ appName: 'atelier', manifest })}`,
+  timeoutSeconds: 260,
+});
+
+export const router = proxy.router;
+
+/** Base URL of the sidecar's HTTP server, or null if it hasn't reported in yet. */
+export const getAtelierServerUrl = proxy.getHttpUrl;