feat(prometheus+spawn): Prometheus engine (stubbed) + manual Pump.fun creator

Built by 2 parallel agents (+ image-API research):
- @pyre/prometheus: generateSpawn() engine — deterministic §9 meta-mixer
  (40/25/20/15), prompt builder ("inspired mutation, not a clone" + no
  people/brands), name/ticker/lore/tagline gen, image-prompt, denylist + moderation
  safety. PROVIDER-ABSTRACTED (TextProvider/ImageProvider/ModerationProvider) with
  deterministic STUBS so it runs keyless today; real call shapes documented (Claude
  Haiku text · FLUX schnell image · OpenAI omni-moderation). 13 tests.
- @pyre/db: migration 002 (prometheus_generations, spawn_records) + record/list/get.
- @pyre/api: admin-gated POST /api/prometheus/generate + /api/spawn/launch
  (x-admin-token; CLOSED with 403 when ADMIN_API_TOKEN unset; timing-safe compare),
  public GET /api/spawns + /api/spawn/:id.
- @pyre/web: public /spawn record page; @pyre/core SpawnRecord type.

Verified: typecheck 8/8, 134 tests (core 91 + prometheus 13 + solana 30), web build
(+/spawn), migrate 002 live, /api/spawns OK, admin gate returns 403 (unconfigured).
Follow-ups: set ADMIN_API_TOKEN to use admin endpoints; wire real provider keys;
receiptId→DB-id wiring; admin generation UI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/db/migrations/002_spawns.sql

@@ -0,0 +1,48 @@
+-- 002_spawns.sql — Prometheus generations + Spawn records (idempotent).
+--
+-- Backs the manual / approval-gated Pump.fun creator workflow (§10, §15):
+--   prometheus_generations — every Spawn package Prometheus generates, with the
+--     mixer input, the raw output, its review status, and the risk flags raised.
+--   spawn_records          — the public, immutable record of a Spawn whose token
+--     was MANUALLY created on Pump.fun by the operator (mint / metadata URI /
+--     Pump.fun URL / launch tx). PYRE never signs the launch (§3) — it only
+--     records it.
+--
+-- Safe to run repeatedly: every object uses IF NOT EXISTS. JSON columns are
+-- JSONB; the TypeScript layer marshals them as parsed objects.
+
+CREATE TABLE IF NOT EXISTS prometheus_generations (
+  id              BIGSERIAL   PRIMARY KEY,
+  -- The cleanup receipt this generation drew its burned-token context from.
+  -- Nullable: a generation can be seeded from a minimal operator-supplied input
+  -- with no backing receipt.
+  receipt_id      BIGINT,
+  input_json      JSONB       NOT NULL,
+  output_json     JSONB       NOT NULL,
+  status          TEXT        NOT NULL DEFAULT 'generated'
+                    CHECK (status IN ('generated', 'approved', 'rejected', 'launched')),
+  risk_flags_json JSONB       NOT NULL DEFAULT '[]',
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  approved_at     TIMESTAMPTZ,
+  rejected_at     TIMESTAMPTZ
+);
+
+CREATE TABLE IF NOT EXISTS spawn_records (
+  id            BIGSERIAL   PRIMARY KEY,
+  generation_id BIGINT      NOT NULL REFERENCES prometheus_generations(id),
+  spawn_name    TEXT        NOT NULL,
+  ticker        TEXT        NOT NULL,
+  mint          TEXT,
+  metadata_uri  TEXT,
+  pumpfun_url   TEXT,
+  launch_tx     TEXT,
+  status        TEXT        NOT NULL DEFAULT 'launched'
+                  CHECK (status IN ('launched', 'pending')),
+  created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_prometheus_generations_receipt_id
+  ON prometheus_generations (receipt_id);
+
+CREATE INDEX IF NOT EXISTS idx_spawn_records_generation_id
+  ON spawn_records (generation_id);