wip: ops admin panel + migration sync + crud/rbac phase-5 snapshot

Working-tree checkpoint of in-progress work carried across prior
sessions on the feat/crud-rbac branch, committed so it lands on the
remote alongside the CI changes.

- Operaciones admin panel: apps/api/src/ops (ingest upload, backup /
  restore / re-import jobs) wired into app.module + RBAC abilities, and
  the apps/web/src/app/operaciones page. docker-compose gets INGEST_DIR
  / BACKUP_DIR volumes; .gitignore excludes migration/ingest + backups.
- migration/sync.py plus transform_*.py / run_all / config / dbenv /
  blob_extract adjustments for the additive sync path.
- crud/rbac phase-5 web bits: AppShell, api/labels/types libs, globals.
- schema.prisma + PLAN/RESUME doc updates.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/api/src/ops/start-job.dto.ts

@@ -0,0 +1,12 @@
+import { IsEnum, IsOptional, IsString } from "class-validator";
+import { OpsJobKind } from "@jorgecuadros/database";
+
+export class StartJobDto {
+  @IsEnum(OpsJobKind)
+  kind!: OpsJobKind;
+
+  /** Target backup filename — required for RESTORE, ignored otherwise. */
+  @IsOptional()
+  @IsString()
+  file?: string;
+}