feat(api): discover processes and expose process-scoped operations for the Extension

[bwl21]

The ChurchTools Extension needs to discover Workspace → Process → Environment before requesting a plan. PR #165 currently exposes workspace-scoped operations, but a workspace may contain several independent ct.config.ts processes. The Extension's request to GET /api/v1/workspaces/{workspaceId}/processes therefore returns 404 on the committed REST API baseline.

Extend #164/#165 with process discovery and process-scoped REST operations while preserving the shared application operations and CLI/REST operation catalog.

Scope

• Discover processes by a root ct.config.ts below explicitly configured workspace roots; stop descending once a process is found and exclude symlinks and generated/dependency directories.
• List discovered processes and expose each process's existing local ct.envs.json environments.
• Route plans and the existing application operations to the selected process, with path containment and prepared-operation bindings covering both workspace and process identity.
• Keep REST/OpenAPI, operation-catalog tests, ownership discovery and documentation consistent. CLI commands still run from the selected process directory.
• Retain the current process-local environment and state layout. This does not implement the environment migration discussed in design(workspace): share environments while keeping process state local #166 or the state layout in design(state): store installation state as one JSON file per resource type #168.

Acceptance

• The ChurchTools Extension can pair with read/plan, select a workspace, process and environment, and request the corresponding plan without manually entering IDs or paths.
• Discovery uses ct.config.ts, not the presence of ct.envs.json, and correctly handles a workspace that is itself a process.
• Process selection cannot escape the configured workspace or redirect a prepared operation to another process.
• Relevant CLI/API parity, discovery, ownership and security tests pass; native macOS ARM64 integration exercises the discovery chain and process plan route.
• Compatibility changes from the initial feat(server): add versioned REST API for Extension clients #165 routes and result shapes are explicitly documented before merging the stacked change.

Existing local implementation was recovered from a preserved work-in-progress stash. It will be reviewed on a separate branch based on feat/164-versioned-rest-api, then integrated into the MG deployment branch for joint testing. Extension reference: bwl21/bwl21_cl-cli_extension at ce700b611f2bf82c7ccee8149031fa6b2bd6bc65.