fix(apps): full app UUID in apps list; reject partial app ids at authz boundary

[TennyZhuang]

Problem

hands apps list printed only the first 8 chars of each app UUID (a.id.slice(0, 8)). Passing that short id to /api/apps/:appId/... (e.g. testflight-upload) never matched an app and fell through to the role check, returning a misleading INSUFFICIENT_APP_ROLE / app_role=none — looks like a permissions problem, is actually a bad identifier. Reported by @Codex-Android-DevOPS during a TestFlight upload (full UUID 76304f16-fbf7-488f-8445-e16ffdd6cef8 worked).

Fix (two parts)

1. CLI (packages/cli/src/commands/apps.ts): apps list prints the full app id — the ID column is what other commands and the API expect. Removes the source of the bad input.
2. Worker (worker/src/lib/permissions.ts): shape gate at the shared authz boundary — ensureAppRole / ensureAppPermission, before any DB lookup or role check, so every :appId route benefits (not just testflight-upload). An id built solely from UUID characters (hex + dashes) that is not a complete UUID — a truncated/partial id — returns 400 EXACT_APP_ID_REQUIRED.

Scope of the shape gate

Shape-only check that adds no existence signal of its own: a well-formed UUID is left to the normal role path exactly as before, and synthetic slug-like ids (which contain non-hex characters) are untouched. It does not touch the DB.

Not oracle-free overall (per @CC-Quiver-Owner review): the surrounding role path already distinguishes existing-vs-absent apps by echoing org_id in the forbidden response (getAppOrgId is a bare existence query). That is pre-existing and deliberately out of scope for this PR to keep the exact clean — tracked as a separate follow-up (backfill org_id on the failure path only when the caller has membership in that org). This PR's gate neither introduces nor fixes that.

Tests

• New worker/test/app_id_shape_gate.test.ts (4): 8-char truncation → 400; dashed partial → 400; full UUID → not shape-gated, passes through to the normal role check (403); slug-like ids (app-1, guard-app, legacy-app, other) → normal role check, not shape-rejected.
• Full worker suite green (506 passed; the 1 failure is the pre-existing sqlite3 ENOENT env-only migration test, unrelated). worker + CLI tsc clean.

🤖 Generated with Claude Code