Run Deck as the workflow owner, and drop the job interval

Workflows were being switched off with "its board no longer exists or is
no longer available to you" for boards that were perfectly intact.

Deck does not read the session for permissions. PermissionService -- the
class behind every check, including the ones inside CardService::reorder()
-- takes the current user as a plain `private ?string $userId`, filled
from the app container's `userId` service (ISession::get('user_id'),
registered shared). Pimple resolves that once per process and caches it,
and ServerContainer caches Deck's app container just as long. In cron the
value is null whenever a Deck-owned job ran earlier in the same pass, and
otherwise the first workflow owner touched -- never the user being
impersonated. null fails every check, so Deck answered NoPermissionException
for an untouched board and findStackIds() read that as "the board is gone".

IUserSession::setUser() never had any effect on this path.

- DeckIntegrationService::beginUserContext()/endUserContext() pin
  PermissionService (mandatory), CardService, BoardService and
  ActivityManager (best effort) to the workflow owner, and restore them
  afterwards. If PermissionService cannot be pinned, the runner skips that
  user instead of acting under someone else's permissions.
- findStackIds() now takes the uid as an argument and is assembled from
  pieces that cannot answer for the wrong user: BoardMapper and StackMapper
  carry no user state, and getPermissions() is handed the uid explicitly.
  It no longer goes through StackService::findAll().
- NoPermissionException is no longer treated as "board missing". Unknown
  failures throw, which leaves the workflow enabled.

This also fixes the second half of the same defect: card moves silently
failed for every user except the first one processed in a cron pass.

Separately, RunWorkflowsJob is now a plain Job instead of a TimedJob and
runs on every cron pass. The workflow_deck_automation.interval config key
is gone. Time sensitivity is no longer merely declared but structurally
unreachable: JobList::add() leaves the column at its TIME_SENSITIVE
default, and the ratchet in setLastRun() only fires for TimedJob.

lib/Service/WorkflowRunner.php

@@ -18,12 +18,15 @@ use Throwable;
 /**
  * Evaluates all enabled workflows and moves overdue cards.
  *
- * Deck's permission checks read the *live* user session, not a value
- * frozen at construction, and this runner has to evaluate rules for many
- * different users within a single background-job process. So workflows
- * are grouped by owner and, for each owner, we temporarily impersonate
- * that user (push their IUser onto the session, restore afterwards) —
- * the standard Nextcloud pattern for multi-user cron jobs.
+ * This runner has to evaluate rules for many different users within a
+ * single background-job process, so workflows are grouped by owner and
+ * each owner is impersonated in turn. Impersonation here means two
+ * things, and the second one is the load-bearing half: pushing the IUser
+ * onto the session (the standard Nextcloud cron pattern), *and* pinning
+ * Deck itself to that user via
+ * DeckIntegrationService::beginUserContext(), because Deck's permission
+ * checks never consult the session — they read a uid frozen once per
+ * process. Both are undone in a finally.
  */
 class WorkflowRunner {
 	public const TARGET_BOARD = 'board';
@@ -93,7 +96,20 @@ class WorkflowRunner {
 			return;
 		}
 
-		$this->impersonate($user);
+		try {
+			$this->impersonate($user);
+		} catch (DeckUnavailableException $e) {
+			// Deck could not be pinned to this user, so every permission
+			// check would be answered for somebody else. Skipping costs one
+			// run; continuing would move the wrong cards or, worse, read a
+			// denial as "the board is gone" and disable a working workflow.
+			$this->logger->error('Could not impersonate {user} towards Deck: ' . $e->getMessage(), [
+				'app' => 'workflow_deck_automation',
+				'user' => $userId,
+			]);
+			return;
+		}
+
 		try {
 			foreach ($workflows as $workflow) {
 				// Same reasoning as in run(): one broken workflow must not
@@ -115,7 +131,7 @@ class WorkflowRunner {
 
 	private function runWorkflow(IUser $user, Workflow $workflow): void {
 		try {
-			$brokenTarget = $this->findBrokenTarget($workflow);
+			$brokenTarget = $this->findBrokenTarget($user, $workflow);
 		} catch (DeckUnavailableException $e) {
 			// Could not determine it either way — leave the workflow alone
 			// rather than disabling it over a temporary Deck problem.
@@ -173,8 +189,8 @@ class WorkflowRunner {
 	 * @return self::TARGET_*|null
 	 * @throws DeckUnavailableException if Deck could not be asked
 	 */
-	private function findBrokenTarget(Workflow $workflow): ?string {
-		$stackIds = $this->deckService->findStackIds($workflow->getBoardId());
+	private function findBrokenTarget(IUser $user, Workflow $workflow): ?string {
+		$stackIds = $this->deckService->findStackIds($workflow->getBoardId(), $user->getUID());
 		if ($stackIds === null) {
 			return self::TARGET_BOARD;
 		}
@@ -257,6 +273,9 @@ class WorkflowRunner {
 		return true;
 	}
 
+	/**
+	 * @throws DeckUnavailableException if Deck cannot be pinned to $user
+	 */
 	private function impersonate(IUser $user): void {
 		$this->impersonationRestore = $this->userSession->getUser();
 		$this->userSession->setUser($user);
@@ -269,9 +288,20 @@ class WorkflowRunner {
 				'app' => 'workflow_deck_automation',
 			]);
 		}
+
+		try {
+			// The session switch above is necessary but nowhere near
+			// sufficient — Deck's permission checks never look at it. See
+			// DeckIntegrationService::beginUserContext().
+			$this->deckService->beginUserContext($user);
+		} catch (DeckUnavailableException $e) {
+			$this->clearImpersonation();
+			throw $e;
+		}
 	}
 
 	private function clearImpersonation(): void {
+		$this->deckService->endUserContext();
 		$this->userSession->setUser($this->impersonationRestore);
 		$this->impersonationRestore = null;
 	}