feat: add Workday ATS integration - #668

Summary

Adds Workday as an ATS integration for Revert, covering the connection flow, tenant-aware API routing, unified ATS objects, client configuration, and regression coverage.

Fixes #372

/claim #372

What changed

• OAuth + refresh: Workday authorization-code exchange, connection persistence, and refresh-token flow using tenant-derived OAuth endpoints.
• Tenant URL handling: resolves Recruiting, Staffing, token, and authorization URLs from the per-app Organisation URL with optional environment fallbacks.
• ATS services: Candidate get/list/create/update; Job get/list/create/update; Offer get/list; Department get/list; and generic Workday proxy routing.
• Normalization: candidate/name/email/phone shapes, requisition/status descriptors, offer references, and department parent descriptors.
• Write mappings: Workday candidate/job disunification and standard ATS field mappings.
• Database: workday Prisma enum + migration + seed support.
• Client/SDK: Organisation URL credentials field, integration metadata, OAuth callback handling, and JS SDK connect flow.
• Security hardening: the Workday proxy rejects cross-origin targets and only allows the configured tenant's Recruiting/Staffing API prefixes before adding the bearer token. This blocks arbitrary hosts, OAuth endpoints, and other tenants on the same Workday origin.

Verification

Passed locally:

yarn workspace @revertdotdev/backend test helpers/ats/workday.test.ts --runInBand
Test Suites: 1 passed, 1 total
Tests:       16 passed, 16 total

PGSQL_URL=<local placeholder> yarn workspace @revertdotdev/backend exec prisma validate
The schema is valid

yarn exec prettier --check <changed TS/TSX files>
All matched files use Prettier code style!

git diff --check
# clean

yarn workspace @revertdotdev/backend exec prisma generate also completed successfully.

A final reconnect audit also verified that Workday app_config and tp_account_url are preserved across connection upserts so tenant routing and refresh-token flows remain intact after reconnect.

Repository-level blockers observed

• Full backend typecheck requires the Fern-generated packages/backend/generated/typescript tree. Running yarn fern in this environment stops with Login required.
• The JS SDK build stops in the existing @types/lodash declarations with TS1005 errors before reaching this change.
• The client production build stops on existing unused botToken / setBotToken warnings in EditCredentials.tsx; those same lines are present on main.

Demo video