fix(server): scope observations to their workspace

[FelixTJDietrich]

Description

Observations now carry an explicit workspace owner, so the existing SQL tenancy inspector can enforce workspace isolation on every repository query without a repository-wide bypass. The database also preserves each observation's provenance by requiring its evaluated practice revision and preventing the referenced practice or revision from being deleted while observations still depend on it.

The migration:

• backfills observation.workspace_id from the owning practice;
• rejects cross-workspace practice references with a composite foreign key;
• changes the practice and practice-revision relationships from destructive deletion behavior to restricted deletion;
• keeps workspace purge and SCM/conversation erasure working through the explicit workspace column; and
• updates the generated ERD and adds architecture, repository, erasure, and production-schema regression coverage.

This PR is the second layer of the stack and targets #1454. Review #1454 first; this PR contains only the observation tenancy and provenance changes on top of it.

Fixes #1505

How to test

Automated validation completed locally on the final commit:

• pnpm run format
• pnpm run check
• ObservationRepositoryIntegrationTest — 17 tests passed
• ProductionSchemaContractIntegrationTest — 22 database-contract tests passed
• MultiTenancyArchitectureTest — 9 architecture tests passed
• targeted observation consumers — 77 unit tests passed
• a fresh PostgreSQL schema applied all 950 Liquibase changesets successfully
• pnpm run db:generate-erd-docs regenerated the ERD successfully

For a manual smoke test:

1. Apply the Liquibase migration to a database containing observations.
2. Confirm each observation has the same workspace_id as its referenced practice and a non-null practice_revision_id.
3. Confirm deleting a referenced practice or practice revision is rejected and the observation remains readable.
4. Purge a workspace, then confirm its observations and dependent feedback/reaction rows are removed.

Checklist

• My changeset summary reads as an operator/user-facing note (it becomes the changelog entry) — see .changeset/README.md
• No operator action is required; the schema migration and backfill run automatically.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0e94240-cf98-47a7-8619-38656422666b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

This PR includes documentation changes. A preview has been deployed:

🔗 View Docs Preview

_{Preview for commit e97346d. Updates automatically on new commits.}