Allow setting a custom cover image on workflow dashboard cards

[Ma77Ball]

Feature Summary

Workflow cards in the dashboard all share one default background image, so there is no way to visually distinguish workflows at a glance. This adds an optional per-workflow cover image that an owner can set or reset from the card, stored on the backend so it syncs across browsers and devices for anyone with access.

Proposed Solution or Design

• Add a workflow_cover_image(wid, image) table (image stored as a downscaled JPEG data URL, FK to workflow with ON DELETE CASCADE), plus a sql/updates migration.
• Add access-gated GET/PUT/DELETE /workflow/{wid}/cover endpoints on WorkflowResource (read access to fetch, write access to set/delete; data-URL and size validation on set).
• Add a WorkflowCoverService that downscales/re-encodes the chosen file to a small JPEG data URL before upload.
• Add hover controls on the workflow card (camera to pick an image, rollback to reset to default), shown only to the owner in private search; previewImage prefers the stored cover.