feat(W3): expiry sync / full reconciliation sweep (schedule */5) + design + tested compute

- Single Code-node sweep: desired = CP-active paths UNION active AccessGrants;
  expiry excluded -> role/update rewrite; optional auto-disable (env-gated, default off)
- disable guard: only when had scopes before (never fresh empty-role customer)
- loop guard: no NocoDB Customers.status flip (avoids W1 re-provision loop)
- test_w3.js mock-verified both AUTO_DISABLE modes; gen_w3.js builds JSON from w3-compute.js

n8n/gen_w3.js

@@ -0,0 +1,47 @@
+// Builds n8n/W3-expiry-sync.json from w3-compute.js (single source of truth).
+// Run: node n8n/gen_w3.js
+const fs = require('fs');
+const path = require('path');
+const jsCode = fs.readFileSync(path.join(__dirname, 'w3-compute.js'), 'utf8');
+
+const workflow = {
+  name: 'W3 - Expiry Sync (AList Role Reconciliation)',
+  nodes: [
+    {
+      parameters: {
+        rule: {
+          interval: [
+            { field: 'minutes', minutesInterval: 5 }
+          ]
+        }
+      },
+      id: 'trigger-schedule',
+      name: 'Every 5 minutes',
+      type: 'n8n-nodes-base.scheduleTrigger',
+      typeVersion: 1.2,
+      position: [0, 0]
+    },
+    {
+      parameters: { jsCode },
+      id: 'reconcile',
+      name: 'Reconcile & Apply (Expiry Sweep)',
+      type: 'n8n-nodes-base.code',
+      typeVersion: 2,
+      position: [220, 0]
+    }
+  ],
+  connections: {
+    'Every 5 minutes': {
+      main: [
+        [
+          { node: 'Reconcile & Apply (Expiry Sweep)', type: 'main', index: 0 }
+        ]
+      ]
+    }
+  },
+  settings: { executionOrder: 'v1' },
+  pinData: {}
+};
+
+fs.writeFileSync(path.join(__dirname, 'W3-expiry-sync.json'), JSON.stringify(workflow, null, 2) + '\n');
+console.log('wrote W3-expiry-sync.json (' + jsCode.length + ' chars jsCode)');