Centralize template extension, magic-byte, and HTML/script rejection in upload.ValidateTemplate so admin template POST matches project asset hardening.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose draft/validate/publish/retire workflow APIs and template upload/list
routes wired to workflowdef service with DBCatalog refresh on publish.
Co-authored-by: Cursor <cursoragent@cursor.com>