CUST-WP-0074-T02: task wait qualifiers in the hub read model

Adds tasks.decision_id and workplan_dependencies.from_task_id (migration
e8f9a0b1c2d3). A from_task_id column is needed rather than
from_workplan_id plus description: the partial unique indexes key on
(from_workplan_id, target, relationship_type), so two tasks in one
workplan waiting on the same target could not both be indexed, and the
derived wait_kind needs per-task attribution. The two existing unique
indexes are narrowed to frontmatter edges (from_task_id IS NULL) and two
task-origin counterparts are added; downgrade deletes task-origin rows
before restoring the old indexes.

POST /workplans/{id}/dependencies/ accepts from_task_id (must belong to
the from workplan; a task cannot depend on itself). TaskCreate/Update/Read
carry decision_id.

Derived read-model fields, no new write routes (rule 5):
- TaskRead.wait_kind: external | human | both | unqualified, null unless
  status is wait (dependency rows from this task / needs_human).
- WorkplanRead.blocked_kind: human | external | none, null unless status
  is blocked. Human wins over external.
Both come from api/services/wait_kind.py, applied on GET /tasks/,
GET /tasks/{id}, GET /workplans/ and GET /workplans/{id}.

The identifier-migration reference-count proof now includes from_task_id
(FK count guard 22 -> 23).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 237582@bnt-lap001
Assistant-Session: f2b3d9f1-8fb9-4b9c-bc2b-837ec5dfc826

api/routers/workstream_dependencies.py

@@ -36,9 +36,16 @@ async def _create_dependency(
         raise HTTPException(status_code=404, detail="target task not found")
     if workplan_id == body.to_workplan_id:
         raise HTTPException(status_code=422, detail="a workplan cannot depend on itself")
+    if body.from_task_id is not None:
+        from_task = await session.get(Task, body.from_task_id)
+        if from_task is None or from_task.workplan_id != workplan_id:
+            raise HTTPException(status_code=404, detail="from task not found in this workplan")
+        if body.from_task_id == body.to_task_id:
+            raise HTTPException(status_code=422, detail="a task cannot depend on itself")
 
     dep = WorkplanDependency(
         from_workplan_id=workplan_id,
+        from_task_id=body.from_task_id,
         to_workplan_id=body.to_workplan_id,
         to_task_id=body.to_task_id,
         relationship_type=body.relationship_type,