Rebuild Dispatch with shared services and private DSP state

[dillonlille]

Replace per-DSP application installations with one shared dashboard, API, account service, job runner, auth broker, and provider worker implementation. DSPs now contain private state only. A permanent Dev DSP routes to a separate Preview artifact, and production promotion requires the exact artifact approved on Preview.

The rebuild includes role-based workspace access, invitations and password recovery, DSP lifecycle and audit records, Paycom connections and verification, scheduled collection, employees and timecards, immutable build inventories, controlled activation/rollback tooling, and offline backup/restore. The Plugins page and legacy per-DSP installation framework are removed.

This is a fresh-setup repository. It does not migrate archived platform state automatically. There is no release-publishing or deployment workflow, and building or merging starts no services. Runtime directories and the retained archive are untouched.

Validation:

• TypeScript, formatting, Git whitespace, and production dependency audit pass.
• 15 service/security/provider tests pass; heavier suites are exercised separately.
• Three built-dashboard browser flows pass, including mobile membership boundaries and accepting an invitation while another account is signed in.
• Native local fixtures pass login, verification, collection, persistent-session reuse, DSP profile separation, and restricted egress.
• The compiled supervisor simulation passes Preview activation, exact-artifact promotion, private-state preservation, and rollback after failed startup.

Native fixture tests retain the outer Linux sandbox and use a local-only exception for Chromium's inner sandbox because of this host's existing AppArmor policy. Production keeps the inner sandbox mandatory. Compatible production-host setup and real Paycom/account acceptance remain deployment prerequisites; no host policy or live provider credentials were changed or used.