feat(#168): Implement job steps tracking

Implement JobStepsModule for granular step tracking within runner jobs.

Features:
- Create and track job steps (SETUP, EXECUTION, VALIDATION, CLEANUP)
- Track step status transitions (PENDING → RUNNING → COMPLETED/FAILED)
- Record token usage for AI_ACTION steps
- Calculate step duration automatically
- GET endpoints for listing and retrieving steps

Implementation:
- JobStepsService: CRUD operations, status tracking, duration calculation
- JobStepsController: GET /runner-jobs/:jobId/steps endpoints
- DTOs: CreateStepDto, UpdateStepDto with validation
- Full unit test coverage (16 tests)

Quality gates:
- Build: ✅ Passed
- Lint: ✅ Passed
- Tests: ✅ 16/16 passed
- Coverage: ✅ 100% statements, 100% functions, 100% lines, 83.33% branches

Also fixed pre-existing TypeScript strict mode issue in job-events DTO.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/src/job-steps/job-steps.controller.ts

@@ -0,0 +1,42 @@
+import { Controller, Get, Param, UseGuards } from "@nestjs/common";
+import { JobStepsService } from "./job-steps.service";
+import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { Permission, RequirePermission } from "../common/decorators";
+
+/**
+ * Controller for job steps endpoints
+ * All endpoints require authentication and workspace context
+ *
+ * Guards are applied in order:
+ * 1. AuthGuard - Verifies user authentication
+ * 2. WorkspaceGuard - Validates workspace access and sets RLS context
+ * 3. PermissionGuard - Checks role-based permissions
+ */
+@Controller("runner-jobs/:jobId/steps")
+@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
+export class JobStepsController {
+  constructor(private readonly jobStepsService: JobStepsService) {}
+
+  /**
+   * GET /api/runner-jobs/:jobId/steps
+   * Get all steps for a job
+   * Requires: Any workspace member
+   */
+  @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findAll(@Param("jobId") jobId: string) {
+    return this.jobStepsService.findAllByJob(jobId);
+  }
+
+  /**
+   * GET /api/runner-jobs/:jobId/steps/:stepId
+   * Get a single step by ID
+   * Requires: Any workspace member
+   */
+  @Get(":stepId")
+  @RequirePermission(Permission.WORKSPACE_ANY)
+  async findOne(@Param("jobId") jobId: string, @Param("stepId") stepId: string) {
+    return this.jobStepsService.findOne(stepId, jobId);
+  }
+}