feat(#168): Implement job steps tracking

Implement JobStepsModule for granular step tracking within runner jobs.

Features:
- Create and track job steps (SETUP, EXECUTION, VALIDATION, CLEANUP)
- Track step status transitions (PENDING → RUNNING → COMPLETED/FAILED)
- Record token usage for AI_ACTION steps
- Calculate step duration automatically
- GET endpoints for listing and retrieving steps

Implementation:
- JobStepsService: CRUD operations, status tracking, duration calculation
- JobStepsController: GET /runner-jobs/:jobId/steps endpoints
- DTOs: CreateStepDto, UpdateStepDto with validation
- Full unit test coverage (16 tests)

Quality gates:
- Build: ✅ Passed
- Lint: ✅ Passed
- Tests: ✅ 16/16 passed
- Coverage: ✅ 100% statements, 100% functions, 100% lines, 83.33% branches

Also fixed pre-existing TypeScript strict mode issue in job-events DTO.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/src/job-events/job-events.controller.ts

@@ -0,0 +1,36 @@
+import { Controller, Get, Param, Query, UseGuards } from "@nestjs/common";
+import { JobEventsService } from "./job-events.service";
+import { QueryEventsDto } from "./dto";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { Workspace, Permission, RequirePermission } from "../common/decorators";
+
+/**
+ * Controller for job events endpoints
+ * Provides read-only access to job events for audit logging
+ *
+ * Guards are applied in order:
+ * 1. AuthGuard - Verifies user authentication
+ * 2. WorkspaceGuard - Validates workspace access and sets RLS context
+ * 3. PermissionGuard - Checks role-based permissions
+ */
+@Controller("runner-jobs/:jobId/events")
+@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
+export class JobEventsController {
+  constructor(private readonly jobEventsService: JobEventsService) {}
+
+  /**
+   * GET /api/runner-jobs/:jobId/events
+   * Get paginated events for a specific job
+   * Requires: Any workspace member (including GUEST)
+   */
+  @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async getEvents(
+    @Param("jobId") jobId: string,
+    @Query() query: QueryEventsDto,
+    @Workspace() _workspaceId: string
+  ) {
+    return this.jobEventsService.getEventsByJobId(jobId, query);
+  }
+}