feature(multitenancy): Correct instance-wide default config for cron jobs under multitenancy

[oleksandrd-flamingo]

Correct instance-wide default config for cron jobs under multitenancy

Under shared-DB multitenancy, unpinned readers — every cron, worker, and the boot path — read app_config_json with a bare LIMIT 1, returning an arbitrary row.

Changes:

• Deterministic reads (app_configs.go): unpinned multitenant reads now select the instance row WHERE id = 1;
• pinned reads keep their tenant row;
• non-multitenant deployments keep the upstream statement byte-identical. A missing row falls back to OpenframeDefaultAppConfig() instead of a zero-value config.
• Migration 20260831000001: seeds the instance row with openframe defaults if absent, repairs a degenerate one via JSON_MERGE_PATCH (feature flags only, sibling keys untouched), and reserves team id 1 (AUTO_INCREMENT = 2) so no tenant config can collide with the instance row. Idempotent; tenant rows never touched.

Docs updated (multitenancy contract + fork manifest); OpenframeDefaultAppConfig moved to server/fleet (migration can't import the mysql package).

Tests: pure decision-table tests + MySQL-backed tests for row selection, seed, repair, and team-id-1 reservation (MYSQL_TEST=1, all green).

No API changes

Backward compatible in both rollout directions (old binary on migrated DB and vice versa are safe).