feat: add Workable ATS integration

[nexiumbiz-debug]

/claim #551

This PR adds Workable as an ATS integration.

What changed

• Adds the workable TP_ID enum value and Prisma migration.
• Adds Workable basic-token auth with subdomain storage.
• Wires Workable metadata, default scopes, field mappings, seed mappings, and ATS routing.
• Adds Workable support for jobs, candidates, departments, offers, and ATS proxy where Workable's API supports the action.
• Adds SDK/UI affordances for Workable API key + subdomain setup.

Notes

• Workable write support is intentionally limited to supported endpoints; unsupported job, offer, and candidate update/delete actions return the existing unsupported response shape.
• This was prepared transparently with AI-assisted Codex work.

Verification

• npx -y prettier@3.3.2 --check ... passed for modified TS/TSX files.
• git diff --check passed.
• corepack yarn install --immutable completed successfully after freeing disk space; remaining output was existing peer dependency warnings.
• NODE_OPTIONS=--use-system-ca corepack yarn workspace @revertdotdev/backend exec prisma generate --schema prisma/schema.prisma succeeded and regenerated Prisma Client with the new workable enum value.
• corepack yarn build confirmed the @revertdotdev/revert-ui production build succeeds with only existing unused-state warnings in EditCredentials.tsx.

Local limitations

• Full root build on Windows still hits the existing backend script mkdir -p ... && cp ..., where cp is unavailable under cmd.exe.
• Backend tsc --noEmit gets past Prisma, then stops on missing Fern-generated packages/backend/generated/typescript files; yarn fern requires Fern login in this environment.
• @revertdotdev/js prebuild fails before project code because its TypeScript 4.6 compiler cannot parse the currently installed @types/lodash declarations.
• One Next workspace in the root build cannot fetch Google Fonts locally due this machine's Node CA store; --use-system-ca fixed Prisma downloads but I did not bypass certificate checks.

[github-actions]

Thank you for following the naming conventions for pull request titles! 🙏

[nexiumbiz-debug]

Follow-up local verification after freeing disk space:

• corepack yarn install --immutable now completes successfully; remaining output is existing peer dependency warnings.
• NODE_OPTIONS=--use-system-ca corepack yarn workspace @revertdotdev/backend exec prisma generate --schema prisma/schema.prisma succeeds and regenerates Prisma Client with the new workable enum value.
• corepack yarn build confirms @revertdotdev/revert-ui production build succeeds with only existing unused-state warnings in EditCredentials.tsx.
• git diff --check passes.

Still blocked locally:

• Full root build on Windows hits the existing backend script mkdir -p ... && cp ..., where cp is unavailable under cmd.exe.
• Backend tsc --noEmit now gets past Prisma, then stops on missing Fern-generated packages/backend/generated/typescript files; yarn fern requires Fern login in this environment.
• @revertdotdev/js prebuild fails before project code because its TS 4.6 compiler cannot parse the currently installed @types/lodash declarations.
• One Next workspace in the root build cannot fetch Google Fonts locally due this machine's Node CA store; --use-system-ca fixed Prisma downloads but I did not bypass certificate checks.

[nexiumbiz-debug]

Hey, just checking whether this Workable pass is close to what you wanted. The visible PR check is green now, and I was able to get install, Prisma generation, the UI build, and diff checks through locally after the earlier disk-space issue. If you want a smaller first slice or a different auth shape for Workable, I can adjust it.

[nexiumbiz-debug]

Added a short credential-free demo video for the Workable integration acceptance requirement:
https://github.com/nexiumbiz-debug/revert/releases/download/workable-demo-20260517/revert-workable-demo-20260517.mp4

It walks through the Workable TP_ID/metadata setup, API-key/subdomain connection path, ATS route coverage, unsupported-operation behavior, and local verification already listed in the PR. I did not use or request a private Workable account or live credential for the demo.

[nexiumbiz-debug]

Gentle follow-up on the Workable bounty after the credential-free demo above. Does this shape satisfy what you wanted for the first Workable integration pass, or would you prefer I narrow it to a smaller mergeable slice around connection/auth + metadata first?