Identity consistency: slug webhooks, pipeline refs by slug, dead-code cleanup

[martsokha]

Follow-up to the slug/number identity redesign. An audit of the handler layer found three remaining UUID inconsistencies; this closes them so every workspace-owned config resource is addressed the same way.

Webhooks by slug

Webhooks were the only workspace config resource still UUID-keyed. Now mirror connections/pipelines/policies/contexts:

• Immutable per-workspace slug (migration + UNIQUE(workspace_id, slug) + format/length checks).
• Route {webhookSlug}; CreateWebhook takes a required slug; duplicate → 409.
• Response is slug-only (drops the webhook UUID). find_webhook resolves by slug.

Pipeline policy/context references by slug

A pipeline referenced its policies/contexts by UUID while those resources are slug-addressed everywhere else.

• PipelineDefinition now exposes policySlugs / contextSlugs instead of policyIds / contextIds.
• Write: slugs resolve to ids (scoped to the pipeline's workspace, 404 on any unknown reference) before the join tables are written; the join tables keep UUID foreign keys.
• Read: the referenced slugs are listed back via a join.
• The engine run path still resolves references by id internally (unchanged).

Dead-code cleanup

• Remove unused create_connection_with_unique_slug (connections require an explicit slug; duplicate → 409).
• Remove orphaned WorkspacePathParams / FilePathParams / VersionPathParams path structs (superseded by the slug extractor).

Also: dropped a few historic/changelog-style code comments in favor of current-state docs.

Verification

• cargo check / clippy -D warnings / fmt / rustdoc -D warnings / full test suite — clean.
• Live: webhook routes use {webhookSlug} (no {webhookId}); Webhook response has no webhookId; PipelineDefinition exposes policySlugs/contextSlugs (no policyIds).
• E2E: webhook create-by-slug → 200, dup → 409; policy pii-mask + pipeline policySlugs:["pii-mask"] → 201, reads back ["pii-mask"]; unknown ref slug → 404.

🤖 Generated with Claude Code