fix(api,web): separate workspace context from auth session (#534)

BetterAuth session responses contain only identity fields — workspace
context (workspaceId, currentWorkspaceId) was never returned, causing
"Workspace ID is required" on every guarded endpoint after login.

Add GET /api/workspaces endpoint (AuthGuard only, no WorkspaceGuard)
that returns user workspace memberships with auto-provisioning for
new users. Frontend auth-context now fetches workspaces after session
check and persists the default to localStorage. Race condition in
auto-provisioning is guarded by re-querying inside the transaction.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/components/chat/Chat.tsx

@@ -5,6 +5,7 @@ import { useAuth } from "@/lib/auth/auth-context";
 import { useChat } from "@/hooks/useChat";
 import { useOrchestratorCommands } from "@/hooks/useOrchestratorCommands";
 import { useWebSocket } from "@/hooks/useWebSocket";
+import { useWorkspaceId } from "@/lib/hooks";
 import { MessageList } from "./MessageList";
 import { ChatInput, type ModelId, DEFAULT_TEMPERATURE, DEFAULT_MAX_TOKENS } from "./ChatInput";
 import { ChatEmptyState } from "./ChatEmptyState";
@@ -89,10 +90,10 @@ export const Chat = forwardRef<ChatRef, ChatProps>(function Chat(
     ...(initialProjectId !== undefined && { projectId: initialProjectId }),
   });
 
-  // Use the actual workspace ID for the WebSocket room subscription.
+  // Read workspace ID from localStorage (set by auth-context after session check).
   // Cookie-based auth (withCredentials) handles authentication, so no explicit
   // token is needed here — pass an empty string as the token placeholder.
-  const workspaceId = user?.currentWorkspaceId ?? user?.workspaceId ?? "";
+  const workspaceId = useWorkspaceId() ?? "";
   const { isConnected: isWsConnected } = useWebSocket(workspaceId, "", {});
 
   const { isCommand, executeCommand } = useOrchestratorCommands();