feat(state-hub): implement v0.5 — dynamic domains & multi-repo

Replaces the hardcoded 6-domain PostgreSQL ENUM with a first-class
`domains` DB table, and adds a `managed_repos` table for multi-repo
support per domain.

P1 — Domain as a DB entity:
- Migration b1c2d3e4f5a6: creates `domains` table, migrates topics.domain
  ENUM column to domain_id FK, drops the domain ENUM type
- Domain ORM model (api/models/domain.py) + Pydantic schemas
- Domain API router: GET/POST /domains/, GET/PATCH /domains/{slug}/,
  rename and archive endpoints with EP/TD cascade on rename
- Topic model updated: domain_id FK + @property domain_slug for
  backwards-compatible JSON serialization (field renamed domain → domain_slug)
- TopicCreate/TopicRead updated; seed.py rewritten to use FK lookup

P2 — Multi-repo support:
- ManagedRepo ORM model (api/models/managed_repo.py) + schemas
- Repo API router: GET/POST /repos/, GET/PATCH /repos/{slug}/, archive
- Makefile: add-domain, rename-domain, add-repo, list-repos targets
- register_project.sh: verify domain via /domains/ API + POST /repos/

P3 — MCP tools & live validation:
- 6 new MCP tools: list_domains, create_domain, rename_domain,
  archive_domain, list_domain_repos, register_repo
- EP/TD routers: replace hardcoded VALID_DOMAINS set with per-request
  DB lookup — returns 422 with list of valid slugs on unknown domain
- State summary: adds domains: list[DomainSummary] (slug, name,
  repo_count, active_workstream_count, ep_count, td_count)
- TOOLS.md updated with domain management section

P4 — Dashboard:
- New domains.md page with KPI row + domain cards + repo lists
- domains.json.py + repos.json.py data loaders
- Domains page added to observablehq.config.js nav
- workstreams.md, extensions.md, techdept.md: domain_slug fix +
  dynamic domain list loaded from /domains/ API (no longer hardcoded)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/technical_debt.py

@@ -5,12 +5,19 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from api.database import get_session
+from api.models.domain import Domain
 from api.models.technical_debt import TDStatus, TechnicalDebt
 from api.schemas.technical_debt import TDCreate, TDRead, TDUpdate
 
 router = APIRouter(prefix="/technical-debt", tags=["technical-debt"])
 
 
+async def _get_valid_domain_slugs(session: AsyncSession) -> set[str]:
+    """Return the set of active domain slugs from the DB."""
+    rows = await session.execute(select(Domain.slug).where(Domain.status == "active"))
+    return {r[0] for r in rows.all()}
+
+
 @router.get("/", response_model=list[TDRead])
 async def list_td(
     domain: str | None = None,
@@ -38,6 +45,12 @@ async def create_td(
     body: TDCreate,
     session: AsyncSession = Depends(get_session),
 ) -> TechnicalDebt:
+    valid_domains = await _get_valid_domain_slugs(session)
+    if body.domain not in valid_domains:
+        raise HTTPException(
+            status_code=422,
+            detail=f"Unknown domain '{body.domain}'. Valid domains: {sorted(valid_domains)}",
+        )
     td = TechnicalDebt(**body.model_dump())
     session.add(td)
     await session.commit()