[codex] Add source-aware Builder database foundation

[3mdistal]

Summary

This draft PR adds the first source-aware database foundation to the Content template, with Builder CMS as the first real integration target.

It gives databases an explicit source layer: source metadata, field mappings, row identity/provenance, change sets, review records, and dry-run execution records. Builder CMS is wired as a read/diff/review target with live writes disabled by default.

What is completed

• Added source/database schema and migrations for:
  • content database sources
  • source field mappings
  • source row identity/provenance
  • source change sets
  • review events
  • execution/dry-run records
• Added source actions for:
  • attach/refresh source
  • inspect source status
  • discover Builder CMS models through configured credentials/MCP
  • propose/review change sets
  • stage Builder revisions locally
  • prepare/validate Builder execution gates
  • prepare one consolidated Builder review payload
  • add a local property backed by a source field
• Added Builder CMS read/write adapter primitives:
  • public Content API read path
  • private-key/MCP-style read path for local Builder testing
  • model discovery via list_builder_models
  • normalized Builder row identity and source fields
  • dry-run write plan generation and validation
  • no live Builder write calls in this slice
• Added a simpler Builder review UX:
  • one Review Builder update flow in database source settings
  • settings/source notification badges for pending Builder updates
  • review modal with grouped changes, destination, risk check, and dry-run result
  • user-facing CTA copy simplified to Push, while still validating only locally
• Moved source details toward database settings and column/property surfaces:
  • Source status now lives under Database settings
  • Database dev/admin link is Code Mode only
  • Column/property UI can show source mapping metadata
  • Add Property can create columns from source fields
• Added a Builder model picker for source attach:
  • local/no-source databases list Builder models from the configured Builder space
  • the user can choose a Builder model from Source settings
  • the selected model name/display name drive the existing attach/import action
  • the picker keeps the flow read-only and shows writes disabled/read-only status
• Added and verified a Builder test-source path:
  • attach can target agent-native-blog-article-test from the picker
  • source attach can import missing Builder source entries as local database rows
  • imported rows remain local database rows with Builder row identity attached
  • re-attaching the source preserves existing source-qualified rows instead of accumulating duplicates
  • Source settings reports live Builder read metadata (Builder API read-only, entry count, matched row count)
• Browser-verified local test data:
  • /page/oJ5v9MB3EiDZ shows the copied Builder blog rows in an existing source-backed QA database
  • /page/sgsxJUlnf3nH verified the new model-picker attach path end to end
  • picker preselected agent-native-blog-article-test, Attach imported 20 rows, and Source settings showed 20 of 20 entries matched

What is not completed yet

• Live Builder writes are still disabled.
  • The Push modal currently validates the push plan/dry run only.
  • Autosave/draft/publish writes need a separate explicit enablement slice.
• OAuth/space authorization UX is not implemented yet.
  • This branch can read Builder through configured credentials/MCP, and users can choose a model once credentials exist, but users cannot yet OAuth into a Builder space from the app UI.
• Full Builder schema-to-column hydration is not complete.
  • The source layer understands mappings and can create source-backed properties, but it does not yet automatically materialize every Builder field as a rich local column.
• Refresh/import reconciliation policy still needs product design.
  • Current behavior preserves local rows and skips already represented source-qualified Builder rows; it does not prune rows that fall out of a limited read window.
• Conflict resolution is foundational, not polished.
  • Source-changed risk flags exist, but the user-facing conflict workflow still needs design.
• Relationships, rollups, derived sources, comments/collaboration, and analytics subscriptions remain future work.

Validation

Passed:

pnpm --filter content exec vitest --run actions/_database-source-utils.test.ts actions/content-database-source-actions.test.ts actions/_builder-cms-read-client.test.ts actions/_builder-cms-source-adapter.test.ts actions/_builder-cms-write-adapter.test.ts app/components/editor/DocumentDatabase.test.ts

Result: 6 files passed, 126 tests passed.

Passed:

pnpm --filter content typecheck

Passed:

git diff --check

Browser verified on local dev server at http://localhost:8086/page/sgsxJUlnf3nH with Builder credentials supplied locally and live writes still disabled.