#76 FTX-76: RunFlow bindings + client (P2)

runflow_bindings table (workflow_id, node_ref, Fernet credential, single_gate mode UB-RF-2, behavior_changes_requested=leave_waiting, behavior_timed_out=reject) + CRUD /v1/runflow/bindings (hitl:binding:manage, credential never echoed); decisions.runflow_binding_id; runflow_client.py (bulkman+resilient_circuit; Bearer UUIDv4 per RunFlow/API_KEYS.md; 409=idempotent success). Phase 7.