feat(web): Add source ingestion workspace

[brayan]

Summary

• Add authenticated pasted source ingestion in apps/web with account-scoped server validation, thin API routes, and a minimal source composer/list UI.
• Persist source metadata and exact pasted text as the initial account-scoped source chunk while keeping list responses metadata-only.

Changes

• Add shared source contracts/schemas and the apps/web/server/sources validation, service, repository, and route-handler helpers.
• Add /api/sources create/list and /api/sources/[sourceId] read routes gated by current account scope.
• Add source workspace UI states for signed-out, empty, loading, validation error, and created source list flows.
• Add synthetic tests for invalid pasted text, exact whitespace preservation, unauthenticated route access, account-scope propagation, and cross-account service filtering.
• Update architecture, roadmap, testing, failure-case, and cost evidence docs for the implemented pasted-source slice.

Testing

• pnpm web:test
• pnpm web:typecheck
• pnpm web:lint
• pnpm repo:test:fast