fix(backend): clean up unique_ext_jwt_token on workspace deletion

The workspace_id column on unique_ext_jwt_token (migration 20260409145556)
has no FK constraint on the workspace table, and delete_workspace did not
remove its rows. Deleted workspaces left orphaned external JWT token records
that kept appearing in the superadmin External JWTs listing.

Add a DELETE FROM unique_ext_jwt_token WHERE workspace_id = $1 alongside the
other per-table cleanup statements in delete_workspace.

Fixes WIN-2078

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM unique_ext_jwt_token WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a"
+}

backend/windmill-api-workspaces/src/workspaces_extra.rs

@@ -847,6 +847,13 @@ pub(crate) async fn delete_workspace(
         .execute(&mut *tx)
         .await?;
 
+    sqlx::query!(
+        "DELETE FROM unique_ext_jwt_token WHERE workspace_id = $1",
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     sqlx::query!("DELETE FROM http_trigger WHERE workspace_id = $1", &w_id)
         .execute(&mut *tx)
         .await?;