Return 422 instead of 500 when workflow create body omits edges, jobs, or triggers

[SAY-5]

Description

This PR fixes a crash in the workflows REST API. POST /api/projects/:project_id/workflows raised an unhandled FunctionClauseError (a 500) instead of a validation error when the request body left out edges, jobs, or triggers entirely, rather than sending them as empty lists.

validate_workflow/2 only had a map clause matching when all three keys were present, so a create body missing any of them matched no clause. The update path is unaffected because it builds a changeset first, which always has those fields via schema defaults. Only create validates the raw params map directly.

The fix adds a fallback clause that defaults the missing keys to [] and routes through the existing validation, which already returns a proper 422 ("Missing edge with source_trigger_id.") for a workflow with no edges.

Closes #4982

Validation steps

1. POST /api/projects/:project_id/workflows with a body of just {"name": "..."} (no edges/jobs/triggers).
2. Before this change the response is a 500; after it, a 422 with the edges validation error.
3. The added test returns 422 when edges, jobs and triggers are omitted covers this in workflows_controller_test.exs.

Additional notes for the reviewer

1. I couldn't run the full ExUnit suite here (it needs Postgres and full deps compilation), so the regression test is written to mirror the neighbouring returns 422 when edges misses a source trigger case and the empty-list path was traced by hand to confirm it lands on {:error, :edges_misses_a_trigger} and the existing reply_422. Please run it in CI.

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our
Responsible AI Policy

Pre-submission checklist

• I have performed an AI review of my code (we recommend using /review
  with Claude Code)
• I have implemented and tested all related authorization policies.
  (e.g., :owner, :admin, :editor, :viewer)
• I have updated the changelog.
• I have ticked a box in "AI usage" in this PR

[lmac-1]

Hey @SAY-5, thank you so much for contributing to fix this issue. Can you please make sure to check the box about AI usage? We don't mind if people use AI, we just want to know ☺️
In the meantime, we'll try to review this in the next week or so.

[SAY-5]

The failing lint job is pre-existing repo-wide drift, not this diff: it's credo --strict flagging TODO tags in core_components.ex/tokens.ex/bootstrap.ex etc plus deps.audit/hex.audit on the lockfile. compile, dialyzer and test_elixir (including the new 422 regression test) are all green on this branch.

[lmac-1]

Thanks for the extra context @SAY-5 🙏🏻, but can you please tick a box in the AI Usage section in the PR description?

[lmac-1]

Hiya @SAY-5, thank you so much for your contribution! This is a clean, well-scoped fix, and the write-up in the description is accurate. Thanks also for ticking the AI usage box 🙏

You mentioned you couldn't run the suite locally, so I ran it here: 56 tests pass, format and Credo clean. I also checked the regression test actually pins the bug. I've verified that removing your fallback clause reproduces the FunctionClauseError, restoring it goes green.

One thing before this can merge: could you merge the latest main into your branch? There's a conflict in CHANGELOG.md.

Optional while you're there: a test for only one key missing (jobs and triggers present, no edges) that crashed the same way and is probably the more common shape. Happy to add it after merge if you'd rather not.

The lint failure looks like pre-existing repo drift rather than your diff so merging main may clear it.

Approving so you're not blocked by me.