fix(workflows): use n8n public activation contract

[tang-vu]

Summary

• read the created n8n workflow ID from the top-level workflow object returned by the Public API
• activate the imported workflow with POST /api/v1/workflows/{id}/activate
• update the endpoint regression test to assert the shipped n8n contract

Why this matters

ODS pins n8nio/n8n:2.6.4. Its Public API create operation returns a workflow object, while activation is a dedicated POST endpoint. The dashboard currently reads data.id and sends a PATCH to /workflows/{id}; therefore POST /api/workflows/{workflow_id}/enable can import a workflow but leaves it inactive while claiming it is active.

Root cause: the router test encoded a response shape and activation method that do not match n8n's Public API. The invariant is that a successful ODS enable request must use the ID returned by create and invoke n8n's activation operation for that exact ID.

Provider contract:

• https://github.com/n8n-io/n8n/blob/n8n%402.6.4/packages/cli/src/public-api/v1/handlers/workflows/spec/paths/workflows.yml
• https://github.com/n8n-io/n8n/blob/n8n%402.6.4/packages/cli/src/public-api/v1/handlers/workflows/spec/paths/workflows.id.activate.yml

Overlap check

Searched open and closed PR titles for n8n workflow activate, n8n activate, and workflow activation, and inspected every open PR touching routers/workflows.py. No PR covers the create-response/activation contract. Related open PRs are independent: #2114/#2749 change installed-workflow name matching, #2748 bounds execution pagination, #2469 validates workflow-list payloads, and #2187 resolves dependency aliases.

Regression test

test_workflow_enable_success exercises the authenticated POST /api/workflows/ok-wf/enable boundary. It now supplies n8n's top-level create response and asserts the second upstream call is POST .../workflows/n8n-99/activate.

Pre-fix evidence: the test failed because the endpoint returned n8nId: null. Post-fix validation:

• pytest tests/test_workflows.py -q — 45 passed
• python -m py_compile routers/workflows.py tests/test_workflows.py — passed
• git diff --check — passed

Tradeoffs and rollback

This keeps the existing ODS response shape and accepted create status codes. It does not change import rollback behavior when n8n activation itself rejects a workflow. Reverting commit 028af113 restores the old behavior; no persisted ODS schema or configuration changes are involved.

Generated with Codex

Batch compatibility

Validated as an independent ten-PR batch from upstream main 6ff9b4fc5190099705043acaab7e9b6ad9c8b8f1. The final PR heads merged without conflicts in this order: #2964 -> #2965 -> #2967 -> #2969 -> #2970 -> #2971 -> #2972 -> #2973 -> #2974 -> #2975. The resulting local synthetic merge head is 4ae60eadad9696a9accb735aad71af87d2be802d.

Combined validation on that exact tree:

• Dashboard API boundary suites: 323 passed, 4 skipped.
• Token Spy suite: 36 passed, 1 skipped.
• Privacy Shield suite: 55 passed.
• APE suite: 47 passed.
• Python compile checks and git diff --check: passed.

The scopes are behaviorally independent. The stated order is the tested rollback/merge sequence for shared-file changes; each PR remains individually useful and revertible.