Add workspace state check and per-workspace delete commands

[jirkasemmler]

Changes:

• New command manage:check-project-workspaces-state — read-only classifier. Input: headerless CSV projectId,workspaceSchema[,componentId,configurationId]. For each row it checks the live API across all dev branches and reports the state (live / config_in_trash / config_live_workspace_gone / purged_or_orphan / access_denied) with a suggested cleanup action, workspaceId, branch and loginType. Makes no changes.
• New command manage:delete-project-workspaces-by-id — deletes single workspaces by id, keeping the parent configuration and its other workspaces (unlike manage:mass-delete-project-workspaces, which deletes the whole configuration and only works via editor sessions, i.e. sandboxes only). With --with-configuration it deletes the whole configuration (trash + purge; handles configurations that are live, already in trash, or fully purged).
• Safety rails: dry-run by default (-f to write); refuses workspaces whose loginType is not a password login unless --any-login-type (protects key-pair siblings of migrated sandboxes); optional expectedSchema CSV column must match the live schema; --with-configuration refuses configurations owning more than the one listed workspace.
• Both commands take a manage token and mint short-lived (30 min) per-project storage tokens (canManageBuckets, plus canPurgeTrash for configuration deletes), dropping them after each project — no interactive token pasting.

Built for the SLSP LEGACY_SERVICE cleanup (DMD-1565), where they executed 215 deletions with zero failures; the tooling is stack-agnostic and reusable for any password-login workspace cleanup.

phpstan level 9 and phpcs clean.

---

Additional notes

⚠️ Don't forget to release new version after merge

🤖 Generated with Claude Code

[jirkasemmler]

Closing in favour of #106, which carries both of these commands.

They are carried over in newer versions than what was on this branch, including two fixes made after this PR was opened:

• DeleteProjectWorkspacesById — a purge refused with storage.components.cannotDeleteConfiguration was swallowed and the row still counted as deleted++. It is now reported and counted as failed, because in that case the configuration is still sitting in the trash and its workspace and backend user still exist. The old behaviour told you a workspace was gone when it was not, which is exactly the failure mode that produced the DMD-1565 / DMD-1594 leftovers.
• CheckProjectWorkspacesState — configuration state was merged across branches, so a configuration live in one branch and trashed in another was misclassified. State is now resolved per branch, with other branches reported in the note column. It also now reports each configuration's most recent job from the Queue API, plus a sanity query so that empty lastJob* columns are not misread as "never used".

Nothing from this PR is dropped. The branch stays, so this is reversible.