fix(api,web): separate workspace context from auth session (#534)

BetterAuth session responses contain only identity fields — workspace
context (workspaceId, currentWorkspaceId) was never returned, causing
"Workspace ID is required" on every guarded endpoint after login.

Add GET /api/workspaces endpoint (AuthGuard only, no WorkspaceGuard)
that returns user workspace memberships with auto-provisioning for
new users. Frontend auth-context now fetches workspaces after session
check and persists the default to localStorage. Race condition in
auto-provisioning is guarded by re-querying inside the transaction.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/lib/auth/auth-context.test.tsx

@@ -10,7 +10,13 @@ vi.mock("../api/client", () => ({
   apiPost: vi.fn(),
 }));
 
+// Mock the workspaces API client
+vi.mock("../api/workspaces", () => ({
+  fetchUserWorkspaces: vi.fn(),
+}));
+
 const { apiGet, apiPost } = await import("../api/client");
+const { fetchUserWorkspaces } = await import("../api/workspaces");
 
 /** Helper: returns a date far in the future (1 hour from now) for session mocks */
 function futureExpiry(): string {
@@ -739,19 +745,26 @@ describe("AuthContext", (): void => {
       vi.restoreAllMocks();
     });
 
-    it("should persist currentWorkspaceId to localStorage after session check", async (): Promise<void> => {
+    it("should call fetchUserWorkspaces after successful session check", async (): Promise<void> => {
       const mockUser: AuthUser = {
         id: "user-1",
         email: "test@example.com",
         name: "Test User",
-        currentWorkspaceId: "ws-current-123",
-        workspaceId: "ws-default-456",
       };
 
       vi.mocked(apiGet).mockResolvedValueOnce({
         user: mockUser,
         session: { id: "session-1", token: "token123", expiresAt: futureExpiry() },
       });
+      vi.mocked(fetchUserWorkspaces).mockResolvedValueOnce([
+        {
+          id: "ws-1",
+          name: "My Workspace",
+          ownerId: "user-1",
+          role: "OWNER",
+          createdAt: "2026-01-01",
+        },
+      ]);
 
       render(
         <AuthProvider>
@@ -763,25 +776,36 @@ describe("AuthContext", (): void => {
         expect(screen.getByTestId("auth-status")).toHaveTextContent("Authenticated");
       });
 
-      // currentWorkspaceId takes priority over workspaceId
-      expect(localStorageMock.setItem).toHaveBeenCalledWith(
-        "mosaic-workspace-id",
-        "ws-current-123"
-      );
+      expect(fetchUserWorkspaces).toHaveBeenCalledTimes(1);
     });
 
-    it("should fall back to workspaceId when currentWorkspaceId is absent", async (): Promise<void> => {
+    it("should persist the first workspace ID to localStorage", async (): Promise<void> => {
       const mockUser: AuthUser = {
         id: "user-1",
         email: "test@example.com",
         name: "Test User",
-        workspaceId: "ws-default-456",
       };
 
       vi.mocked(apiGet).mockResolvedValueOnce({
         user: mockUser,
         session: { id: "session-1", token: "token123", expiresAt: futureExpiry() },
       });
+      vi.mocked(fetchUserWorkspaces).mockResolvedValueOnce([
+        {
+          id: "ws-abc-123",
+          name: "My Workspace",
+          ownerId: "user-1",
+          role: "OWNER",
+          createdAt: "2026-01-01",
+        },
+        {
+          id: "ws-def-456",
+          name: "Second Workspace",
+          ownerId: "other",
+          role: "MEMBER",
+          createdAt: "2026-02-01",
+        },
+      ]);
 
       render(
         <AuthProvider>
@@ -793,24 +817,21 @@ describe("AuthContext", (): void => {
         expect(screen.getByTestId("auth-status")).toHaveTextContent("Authenticated");
       });
 
-      expect(localStorageMock.setItem).toHaveBeenCalledWith(
-        "mosaic-workspace-id",
-        "ws-default-456"
-      );
+      expect(localStorageMock.setItem).toHaveBeenCalledWith("mosaic-workspace-id", "ws-abc-123");
     });
 
-    it("should not write to localStorage when no workspace ID is present on user", async (): Promise<void> => {
+    it("should not write localStorage when fetchUserWorkspaces returns empty array", async (): Promise<void> => {
       const mockUser: AuthUser = {
         id: "user-1",
         email: "test@example.com",
         name: "Test User",
-        // no workspaceId or currentWorkspaceId
       };
 
       vi.mocked(apiGet).mockResolvedValueOnce({
         user: mockUser,
         session: { id: "session-1", token: "token123", expiresAt: futureExpiry() },
       });
+      vi.mocked(fetchUserWorkspaces).mockResolvedValueOnce([]);
 
       render(
         <AuthProvider>
@@ -828,18 +849,53 @@ describe("AuthContext", (): void => {
       );
     });
 
-    it("should remove workspace ID from localStorage on sign-out", async (): Promise<void> => {
+    it("should handle fetchUserWorkspaces failure gracefully — auth still succeeds", async (): Promise<void> => {
       const mockUser: AuthUser = {
         id: "user-1",
         email: "test@example.com",
         name: "Test User",
-        currentWorkspaceId: "ws-current-123",
       };
 
       vi.mocked(apiGet).mockResolvedValueOnce({
         user: mockUser,
         session: { id: "session-1", token: "token123", expiresAt: futureExpiry() },
       });
+      vi.mocked(fetchUserWorkspaces).mockRejectedValueOnce(new Error("Network error"));
+
+      render(
+        <AuthProvider>
+          <TestComponent />
+        </AuthProvider>
+      );
+
+      await waitFor(() => {
+        expect(screen.getByTestId("auth-status")).toHaveTextContent("Authenticated");
+      });
+
+      // Auth succeeded despite workspace fetch failure
+      expect(screen.getByTestId("auth-error")).toHaveTextContent("none");
+    });
+
+    it("should remove workspace ID from localStorage on sign-out", async (): Promise<void> => {
+      const mockUser: AuthUser = {
+        id: "user-1",
+        email: "test@example.com",
+        name: "Test User",
+      };
+
+      vi.mocked(apiGet).mockResolvedValueOnce({
+        user: mockUser,
+        session: { id: "session-1", token: "token123", expiresAt: futureExpiry() },
+      });
+      vi.mocked(fetchUserWorkspaces).mockResolvedValueOnce([
+        {
+          id: "ws-1",
+          name: "My Workspace",
+          ownerId: "user-1",
+          role: "OWNER",
+          createdAt: "2026-01-01",
+        },
+      ]);
       vi.mocked(apiPost).mockResolvedValueOnce({ success: true });
 
       render(