fix(api,web): separate workspace context from auth session (#551)

Co-authored-by: Jason Woltje <jason@diversecanvas.com>
Co-committed-by: Jason Woltje <jason@diversecanvas.com>

apps/web/src/lib/api/index.ts

@@ -15,3 +15,4 @@ export * from "./personalities";
 export * from "./telemetry";
 export * from "./dashboard";
 export * from "./projects";
+export * from "./workspaces";

apps/web/src/lib/api/workspaces.ts

@@ -0,0 +1,26 @@
+/**
+ * Workspaces API Client
+ * User-scoped workspace discovery — does NOT require X-Workspace-Id header.
+ */
+
+import { apiGet } from "./client";
+
+/**
+ * A workspace entry from the user's membership list.
+ * Matches WorkspaceResponseDto from the API.
+ */
+export interface UserWorkspace {
+  id: string;
+  name: string;
+  ownerId: string;
+  role: string;
+  createdAt: string;
+}
+
+/**
+ * Fetch all workspaces the authenticated user is a member of.
+ * The API auto-provisions a default workspace if the user has none.
+ */
+export async function fetchUserWorkspaces(): Promise<UserWorkspace[]> {
+  return apiGet<UserWorkspace[]>("/api/workspaces");
+}