Add workspace lifecycle management via task-complete callback

- Workspaces curl POST /webhook/task-complete/{name} when done
- Orchestrator deletes the workspace via Coder API on callback
- Active workspaces count toward concurrency limit
- GET /queue now shows active workspaces with elapsed time
- Coder template gains callback_url parameter
- TTL becomes a safety net, not the primary shutdown mechanism

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/index.ts

@@ -49,6 +49,17 @@ app.post("/webhook/gitea-pr-review", prReview(config, queue, giteaClient));
 app.post("/webhook/gitea-pr-review-rework", prRework(config, queue));
 app.post("/webhook/gitea-release", release(config, queue));
 
+// ---------------------------------------------------------------------------
+// Task-complete callback — workspaces call this when done
+// ---------------------------------------------------------------------------
+
+app.post("/webhook/task-complete/:name", async (c) => {
+  const name = c.req.param("name");
+  console.log(`[callback] task-complete received for: ${name}`);
+  const found = await queue.taskComplete(name);
+  return c.json({ ok: true, found });
+});
+
 // ---------------------------------------------------------------------------
 // Scheduled maintenance cron (Monday 9:00 AM)
 // ---------------------------------------------------------------------------