AI Welcome scan experience — backend + web profile

When a card is scanned, the public profile can open with a full-bleed,
AI-generated welcome hero before the contact info — experience #10 from the
scan-experiences brief, on the share-token experience selector foundation.

Backend (cardclaws-backend):
- migration 0005_welcome.sql: add cards.welcome JSONB; flows through
  PublicProfile via serde flatten.
- POST /v1/cards/:id/welcome (owner-gated): refine + generate via the existing
  AiClient (nano-banana), store {kind, message, imageDataUrl}.
- card_service::set_welcome + queries::update_welcome; CardRow gains `welcome`.
- 2 tests (generate→public-profile, ownership); workspace gate green (116 tests).
- Verified live with real Gemini end-to-end.

Web (cardclaws-profile):
- WelcomeHero.astro: full-bleed AI hero + greeting + "scroll to connect" cue.
- [handle].astro renders it when the card has a welcome; experience selector
  (?x=profile suppresses) as the lever for the other experiences.
- PublicProfile gains an optional `welcome`; astro check clean.

MVP inlines the image as a data URL; production swaps to an R2 URL (isolated in
the welcome column).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-db/migrations/0005_welcome.sql

@@ -0,0 +1,5 @@
+-- AI Welcome (PRD §21 Phase 5, "scan experiences"): an optional generated
+-- greeting shown when the public profile is scanned. Stored as JSONB:
+--   { "kind": "image", "message": "...", "imageDataUrl": "data:image/png;base64,..." }
+-- (image inlined as a data URL for the MVP; swaps to an R2 URL later).
+ALTER TABLE cards ADD COLUMN welcome JSONB;