fix: cinematic output type guard + legacy_only migration

- Migration 070: seeds 'Cinematic Highlight' output type (legacy_only, no
  workflow link) for fresh installs
- Migration 071: patches existing cinematic output types — clears
  workflow_definition_id and forces legacy_only rollout mode. The row
  existed since 2026-03 with shadow mode + a linked workflow def;
  no BLENDER_CINEMATIC graph node exists so shadow execution would fail.
- API guard in output_types POST + PATCH: cinematic output types cannot
  receive a workflow_definition_id (HTTP 400)
- Defense-in-depth in dispatch_service: early legacy exit if
  render_settings.cinematic is true, regardless of rollout mode
- docs: learning erfasst — cinematic rollout mode footgun

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/api/routers/output_types.py

@@ -271,6 +271,13 @@ async def create_output_type(
     if body.workflow_definition_id is None:
         data["workflow_rollout_mode"] = "legacy_only"
 
+    if data.get("render_settings", {}).get("cinematic") and body.workflow_definition_id is not None:
+        raise HTTPException(
+            400,
+            detail="Cinematic output types cannot be linked to a workflow definition. "
+                   "No BLENDER_CINEMATIC node exists in the workflow graph; cinematic renders use the legacy path only.",
+        )
+
     ot = OutputType(**data)
     db.add(ot)
     await db.commit()
@@ -387,6 +394,14 @@ async def update_output_type(
     if candidate_workflow_definition_id is None:
         data["workflow_rollout_mode"] = "legacy_only"
 
+    candidate_render_settings = data.get("render_settings", ot.render_settings) or {}
+    if candidate_render_settings.get("cinematic") and candidate_workflow_definition_id is not None:
+        raise HTTPException(
+            400,
+            detail="Cinematic output types cannot be linked to a workflow definition. "
+                   "No BLENDER_CINEMATIC node exists in the workflow graph; cinematic renders use the legacy path only.",
+        )
+
     for field_name, value in data.items():
         setattr(ot, field_name, value)
     await db.commit()

backend/app/domains/rendering/dispatch_service.py

@@ -193,6 +193,30 @@ def dispatch_render_with_workflow(order_line_id: str) -> dict:
             )
             return legacy_result
 
+        # Cinematic output types have no BLENDER_CINEMATIC graph node — force legacy regardless
+        # of what workflow_rollout_mode or workflow_definition_id say.
+        if output_type and isinstance(output_type.render_settings, dict) and output_type.render_settings.get("cinematic"):
+            logger.warning(
+                "order_line %s: output_type %s is cinematic but has a workflow_definition_id set; "
+                "forcing legacy dispatch (no BLENDER_CINEMATIC node exists in the workflow graph)",
+                order_line_id,
+                output_type.id,
+            )
+            legacy_result = _legacy_dispatch(order_line_id)
+            legacy_result.update(
+                _build_rollout_signal(
+                    gate_status="cinematic_legacy_only",
+                    ready=False,
+                    reasons=[
+                        "Cinematic output types always use the legacy dispatch path.",
+                        "Remove the workflow_definition_id link to silence this warning.",
+                    ],
+                    workflow_def_id=wf_def.id,
+                    output_type_id=output_type.id,
+                )
+            )
+            return legacy_result
+
         configured_execution_mode = get_workflow_execution_mode(canonical_config, default="legacy")
         workflow_rollout_mode = _normalize_workflow_rollout_mode(
             getattr(output_type, "workflow_rollout_mode", None)