Micro-apps: support 1-level soft relationships between artifact apps

## Why
The generic micro-app tier (`ArtifactRecordEntity` / `artifact_record` table, see `apps/api/src/modules/workflows/infrastructure/artifact-record.entity.ts`) is a single JSON-blob table shared by every installed app, scoped by the `app` column. There is currently no way to reference a row in one app from another. Real FKs are not an option here without breaking the "no per-app DDL, no migration, no redeploy" property the table is built for.

## Proposal
Add a soft-reference convention resolved by `ArtifactRecordsService`, not by the database:
- Schema extension: a property can declare `"x-ref": { "app": "", "on": "id" | "businessKey" }` (extend `AppSchema` in `apps/api/src/modules/workflows/application/artifact-schema.ts`).
- Write-time: `validateBody` resolves each `x-ref` field against the target app's existing rows (respecting the target app's `x-acl`) and rejects (400) if missing.
- Read-time (opt-in): `GET /apps/:app/records?expand=` embeds the referenced record's `data` inline via a second scoped query — still against the same `artifact_record` table, just filtered by a different `app` value.
- 1 level only, no recursive expand — avoids N+1 and cycles.

## Also define
Criteria for when an artifact has "graduated" out of the generic tier (needs real relational integrity, cascades, indexed joins) and should become a proper Rockets module (12-file pattern, dedicated entity, real FK column, migration) instead of stretching `x-ref` further.

## Out of scope
Real TypeORM relations/FK columns on `ArtifactRecordEntity`.