feat(db): mesh data model — meshes, members, invites, audit log

- pgSchema "mesh" with 4 tables isolating the peer mesh domain
- Enums: visibility, transport, tier, role
- audit_log is metadata-only (E2E encryption enforced at broker/client)
- Cascade on mesh delete, soft-delete via archivedAt/revokedAt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.windsurf/workflows/bmad/bmm/workflows/workflow-status.md

@@ -0,0 +1,33 @@
+---
+description: workflow-status
+auto_execution_mode: 1
+---
+
+# Workflow Status - Master Router and Status Tracker
+name: workflow-status
+description: 'Lightweight status checker - answers "what should I do now?" for any agent. Reads YAML status file for workflow tracking. Use workflow-init for new projects.'
+author: "BMad"
+
+# Critical variables from config
+config_source: "{project-root}/_bmad/bmm/config.yaml"
+output_folder: "{config_source}:output_folder"
+user_name: "{config_source}:user_name"
+communication_language: "{config_source}:communication_language"
+document_output_language: "{config_source}:document_output_language"
+user_skill_level: "{config_source}:user_skill_level"
+date: system-generated
+
+# Workflow components
+installed_path: "{project-root}/_bmad/bmm/workflows/workflow-status"
+instructions: "{installed_path}/instructions.md"
+
+# Template for status file creation (used by workflow-init)
+template: "{installed_path}/workflow-status-template.yaml"
+
+# Path definitions for project types
+path_files: "{installed_path}/paths/"
+
+# Output configuration - reads existing status
+default_output_file: "{output_folder}/bmm-workflow-status.yaml"
+
+standalone: true