feat(workbench): persist operational workflows and events

resources/sql/016_metadata_service_identities.sql

@@ -0,0 +1,9 @@
+-- Distinguish non-interactive OAuth identities from human product users.
+-- This migration is intentionally re-runnable.
+
+ALTER TABLE users
+    DROP CONSTRAINT IF EXISTS users_role_check;
+
+ALTER TABLE users
+    ADD CONSTRAINT users_role_check
+    CHECK (role IN ('admin', 'service', 'user'));