Implement Hexis confirmations, disabled-by-default risk, and timeout=>unknown

Closes the biggest gap between the running execution engine and
ECOSYSTEM-SPEC.md §4.3: confirmations were entirely unmodeled, so any
capability could execute unconfirmed regardless of requires_confirmation.

- New confirmations table + Confirmation domain type; POST
  /api/v1/confirmations mints a TTL-bound (120s) confirmation binding
  capability id+version, target entity, and a sorted-key args hash.
- Execute() now requires a valid pending confirmation when the
  capability demands one: rejects missing, expired, consumed, or
  args/version-mismatched confirmations; consumes on success.
- Capabilities gain enabled (destructive risk defaults to disabled,
  matching "must be turned on explicitly") and timeout_seconds.
- One in-flight execution per (capability_id, target_entity_id); a
  second concurrent attempt is rejected (surfaced as 409 over HTTP).
- Wall-clock timeout per capability now wraps the provider call; on
  timeout the outcome is "unknown" (new ExecutionStatus), never
  "failed", and the run is never auto-retried.
- 9 new engine tests cover each guard from the spec's Phase 6 gate.

Vikunja #274.

internal/domain/errors.go

@@ -15,4 +15,13 @@ var (
 	ErrValidation         = errors.New("validation error")
 	ErrInternal           = errors.New("internal error")
 	ErrIdempotencyReplay  = errors.New("idempotent request already processed")
+
+	ErrCapabilityDisabled        = errors.New("capability is disabled")
+	ErrCapabilityVersionMismatch = errors.New("capability version mismatch")
+	ErrConfirmationRequired      = errors.New("confirmation required")
+	ErrConfirmationNotFound      = errors.New("confirmation not found")
+	ErrConfirmationInvalid       = errors.New("confirmation does not match request")
+	ErrConfirmationExpired       = errors.New("confirmation expired")
+	ErrConfirmationConsumed      = errors.New("confirmation already consumed")
+	ErrExecutionInFlight         = errors.New("execution already in flight for this capability and target")
 )