Summary

Adds Workday as a new ATS integration, following the existing patterns established by Greenhouse and Lever integrations.

/claim #372

Changes

Schema & Config

• Added workday to Prisma TP_ID enum
• Added Workday config variables: WORKDAY_CLIENT_ID, WORKDAY_CLIENT_SECRET, WORKDAY_TOKEN_URL, WORKDAY_API_BASE_URL
• Added 'workday' to ATS_TP_ID type, DEFAULT_SCOPE, and mapIntegrationIdToIntegrationName

Authentication

• Created WorkdayAuthHandler (routes/v1/ats/authHandlers/workday.ts) implementing OAuth2 token exchange, following the Lever auth handler pattern
• Wired up case TP_ID.workday in the ATS auth router

ATS Service Endpoints

Added Workday cases to all ATS service files:

• Candidate (CRUD) - Maps to Workday /api/staffing/v6/candidates
• Job (CRUD) - Maps to Workday /api/staffing/v6/jobPostings
• Department (read) - Maps to Workday /api/staffing/v6/organizations
• Offer (read) - Maps to Workday /api/staffing/v6/jobOffers
• Proxy - Generic proxy through Workday API base URL

Data Transforms

• Added Workday field mappings in prisma/fields.ts for all 4 ATS object types (candidate, job, offer, department)
• Added [TP_ID.workday]: {} to postprocessDisUnifyAtsObject preprocess map
• Added case TP_ID.workday to disunifyAtsObject in disunify.ts

Design Decisions

• Workday API base URL is configurable per-connection via app_config.org_url (falls back to WORKDAY_API_BASE_URL env var), since Workday uses tenant-specific URLs
• Offset-based pagination for list endpoints, computing next cursor from total in response
• Delete endpoints return "not supported" (consistent with Workday API constraints)

Test Plan

• Verify TypeScript compilation passes
• Test OAuth2 flow with Workday sandbox credentials
• Test CRUD operations for candidates and jobs
• Test read operations for departments and offers
• Verify proxy endpoint forwards requests correctly