Single box identity: collapse uuid/boxId into one 12-char id (after #748)

[law-chain-hot]

Goal

Collapse the dual identity (uuid PK + boxId) into a single 12-char base62 id.

• box.id becomes the only identity (the user-facing cloud id); drop the uuid PK and the separate boxId column.
• The engine's internal id is never exposed.
• One id threads PG → job → runner → engine.

Blocked on #748

boxId's only consumers are the TS SDK (sdk-typescript/src/Box.ts reads & exposes it) and the legacy dashboard — both removed/migrated by #748 (SDK deleted, dashboard moved to the handwritten cloudBox Box-API client).

Doing this before #748 would force editing the SDK's public type + the old dashboard, and would conflict with #748 (same box files). After #748 it is a small, clean PR: drop boxId from Box entity/DTO/mapper, regenerate clients, fix the few cloudBox/dashboard reads.

Scope (after #748)

• box.entity: id = generateBoxId() (12-char), drop the uuid default + boxId column + its indexes.
• BoxDto / admin DTO: drop boxId; mapper box_id: box.id.
• box.service: collapse findOneByIdOrName / getOrganizationId to id-or-name; drop the by-boxId lookup-cache variants.
• regenerate api-client + api-client-go (Box loses boxId).
• dashboard: cloudBox/box-identity reads .id instead of .boxId.
• migration baseline: box PK → varchar(12) (DB rebuild, pre-launch).

Preserved work

A full implementation already exists on branch feat/box-image-id-clean (the closed #756) — to be rebased onto main after #748 lands. ~18–20 hand-edited files + regen; not large.

Sequence

#758 (curated allowlist, merged) → #748 (contracts + SDK removal) → this.