Adds two enum-style column types where the column declares a fixed set of
options (stable id + name + palette color) and every cell is constrained to
them.

- COLUMN_TYPES gains `select` / `multiselect`; SELECT_COLORS is a fixed,
  theme-aware palette mapping 1:1 to Badge color variants (no raw hex)
- ColumnDefinition.options carries the option set. Cells store option *ids*
  (a string for select, string[] for multiselect) so renaming or recoloring
  an option never rewrites row data
- Row validation enforces membership; coercion tolerantly maps an option
  *name* to its id for tool/import writes and drops unmatched entries
- validateColumnDefinition enforces non-empty, unique-id, unique-name and
  valid-color option sets, and rejects options on non-select columns
- Contract gains selectOptionSchema plus a cross-field refine requiring
  options exactly on select types; routes thread options through type
  changes and a new options-only updateColumnOptions path

No migration: column config already lives in the user_table_definitions
schema JSONB blob.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014e4MvFV1szLhNLap1CCNUd

Addresses review findings on the select/multiselect column types:

- Column type conversion now checks each existing value against the target
  option set (resolve by id or name); a `select`/`multiselect` change is
  blocked when values don't fit, instead of accepting shapes that later
  coercion would strand or silently drop
- Inline select editor discards its draft on Escape (matching the text/date
  editors) rather than committing on menu close
- A required single-select no longer offers "None" — clearing to null could
  never be committed

Exports resolveSelectOptionId from validation for the conversion gate.

Round 2 review fixes:

- A required multiselect can no longer be emptied — the toggle that would
  remove the last option is ignored, since an empty selection can't be
  committed (server rejects it). Mirrors the required single-select "None"
  guard.
- Inline cell save now compares old vs new value structurally, so a no-op
  edit (e.g. opening a multiselect and closing it unchanged, producing a new
  array reference) no longer writes a row update or pushes an undo entry.
  Uses JSON compare for arrays/objects, matching the existing optionsEqual
  convention; primitives keep the === fast path.

Round 3 review fixes:

- Expanded-cell popover normalizes a multiselect's initial value with
  toSelectedIds, so a single option-id string (the normal shape right after a
  select->multiselect conversion, before the row is rewritten) is no longer
  collapsed to an empty array and cleared on save.
- Column PATCH now only routes to updateColumnType on a real type change.
  updateColumnType early-returns on an unchanged type, so a payload repeating
  the current type together with new options previously applied neither; an
  unchanged type with options now routes to the options-only update. Fixed in
  both the internal and v1 column routes.

- Double-clicking a select/multiselect cell now opens the inline option
  dropdown (like date/number) instead of the fixed-height text popover, which
  rendered just a small dropdown floating in a large empty container. Removes
  the now-unreachable ExpandedSelectEditor from the expanded-cell popover.
- Options editor's add/remove controls match the sibling Filter UI: a ghost,
  muted "Add option" button with a small plus, and an X remove icon.

jsonb_array_elements_text throws "cannot extract elements from a scalar" on a
JSON null, which is exactly what a multiselect cell holds once it is cleared,
cut, or has its last option removed — so search failed for the whole table.
Gate the array arm on jsonb_typeof, falling back to the single mapping so a
scalar left over from a single->multi toggle stays searchable.

Swept the other array expansions: the rest are inside UPDATEs whose WHERE
already filters to arrays, or are CASE-guarded. This was the only unguarded one.

…igration

The multi->single guard counted options the same request was dropping, so
trimming a cell to one option and turning multiselect off in one save was
rejected. Reordering fixes that and a latent corruption: the migration keeps a
multi cell's FIRST element, which could be a removed id sitting ahead of a kept
one, so the surviving option would be discarded and the dead one kept.

Removal now runs first, against the pre-toggle cell shape, then the guard
counts what actually remains, then the shape migration runs.

Find also joined multiselect names unordered while sort and export preserve
stored order, so a search for the displayed label could miss.

…g; show the applied filter

The stranded-options guard read the column's current `required`, so a removal
paired with `required: true` cleared cells and then failed the constraint write
— options change committed behind an error — while a removal paired with
`required: false` was blocked despite the column no longer being required. It
now takes the requested value, and also pre-flights already-empty rows when
required is newly imposed.

The filter chip and editor keyed off the raw filter while rows, runs, stops and
deletes used the pruned one, so the UI could claim an active filter the grid
wasn't reflecting. Both now read the applied filter.

…pe change

Pairing unique: true with an options or multiple update on a column that is
ALREADY select skipped the guard, so updateColumnOptions committed and the
separate constraint write then failed — the options change landing behind a
400. Gating on `updates.type ?? currentColumn.type` covers the conversion and
the options-only case with one condition, on both column routes and the
copilot update_column path.

Option ids are caller-supplied strings, so parseScalar turned an id of "1" or
"true" into a number or boolean; JSONB containment then compared the wrong type
and matched nothing while the picker still showed a valid option.

filterRulesToFilter takes the columns and keeps a select value as text, for $in
lists too. pruneFilterForColumns forwards them as well — its round-trip through
rules would otherwise re-coerce the ids it just preserved.