Account/workspace onboarding flow

Self-serve workspace creation wizard (workspace + first team, seeds owner + creator app_user + default states, lands on board); keycloak_sub backfill linking invited members on first sign-in; welcoming new-user empty state. Extensibility refactor (ActivityDispatcher/ActivitySink) landed first.