feat(web): add workspace management UI (M2 #12)

- Create workspace listing page at /settings/workspaces
  - List all user workspaces with role badges
  - Create new workspace functionality
  - Display member count per workspace

- Create workspace detail page at /settings/workspaces/[id]
  - Workspace settings (name, ID, created date)
  - Member management with role editing
  - Invite member functionality
  - Delete workspace (owner only)

- Add workspace components:
  - WorkspaceCard: Display workspace info with role badge
  - WorkspaceSettings: Edit workspace settings and delete
  - MemberList: Display and manage workspace members
  - InviteMember: Send invitations with role selection

- Add WorkspaceMemberWithUser type to shared package
- Follow existing app patterns for styling and structure
- Use mock data (ready for API integration)

apps/api/src/knowledge/knowledge.controller.ts

@@ -8,114 +8,96 @@ import {
   Param,
   Query,
   UseGuards,
-  Request,
-  UnauthorizedException,
 } from "@nestjs/common";
 import { KnowledgeService } from "./knowledge.service";
 import { CreateEntryDto, UpdateEntryDto, EntryQueryDto } from "./dto";
 import { AuthGuard } from "../auth/guards/auth.guard";
+import { WorkspaceGuard, PermissionGuard } from "../common/guards";
+import { Workspace, Permission, RequirePermission } from "../common/decorators";
+import { CurrentUser } from "../auth/decorators/current-user.decorator";
 
 /**
  * Controller for knowledge entry endpoints
- * All endpoints require authentication and enforce workspace isolation
+ * All endpoints require authentication and workspace context
+ * Uses the new guard-based permission system
  */
 @Controller("knowledge/entries")
-@UseGuards(AuthGuard)
+@UseGuards(AuthGuard, WorkspaceGuard, PermissionGuard)
 export class KnowledgeController {
   constructor(private readonly knowledgeService: KnowledgeService) {}
 
   /**
    * GET /api/knowledge/entries
    * List all entries in the workspace with pagination and filtering
+   * Requires: Any workspace member
    */
   @Get()
+  @RequirePermission(Permission.WORKSPACE_ANY)
   async findAll(
-    @Request() req: any,
+    @Workspace() workspaceId: string,
     @Query() query: EntryQueryDto
   ) {
-    const workspaceId = req.user?.workspaceId;
-
-    if (!workspaceId) {
-      throw new UnauthorizedException("Workspace context required");
-    }
-
     return this.knowledgeService.findAll(workspaceId, query);
   }
 
   /**
    * GET /api/knowledge/entries/:slug
    * Get a single entry by slug
+   * Requires: Any workspace member
    */
   @Get(":slug")
+  @RequirePermission(Permission.WORKSPACE_ANY)
   async findOne(
-    @Request() req: any,
+    @Workspace() workspaceId: string,
     @Param("slug") slug: string
   ) {
-    const workspaceId = req.user?.workspaceId;
-
-    if (!workspaceId) {
-      throw new UnauthorizedException("Workspace context required");
-    }
-
     return this.knowledgeService.findOne(workspaceId, slug);
   }
 
   /**
    * POST /api/knowledge/entries
    * Create a new knowledge entry
+   * Requires: MEMBER role or higher
    */
   @Post()
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
   async create(
-    @Request() req: any,
+    @Workspace() workspaceId: string,
+    @CurrentUser() user: any,
     @Body() createDto: CreateEntryDto
   ) {
-    const workspaceId = req.user?.workspaceId;
-    const userId = req.user?.id;
-
-    if (!workspaceId || !userId) {
-      throw new UnauthorizedException("Authentication required");
-    }
-
-    return this.knowledgeService.create(workspaceId, userId, createDto);
+    return this.knowledgeService.create(workspaceId, user.id, createDto);
   }
 
   /**
    * PUT /api/knowledge/entries/:slug
    * Update an existing entry
+   * Requires: MEMBER role or higher
    */
   @Put(":slug")
+  @RequirePermission(Permission.WORKSPACE_MEMBER)
   async update(
-    @Request() req: any,
+    @Workspace() workspaceId: string,
     @Param("slug") slug: string,
+    @CurrentUser() user: any,
     @Body() updateDto: UpdateEntryDto
   ) {
-    const workspaceId = req.user?.workspaceId;
-    const userId = req.user?.id;
-
-    if (!workspaceId || !userId) {
-      throw new UnauthorizedException("Authentication required");
-    }
-
-    return this.knowledgeService.update(workspaceId, slug, userId, updateDto);
+    return this.knowledgeService.update(workspaceId, slug, user.id, updateDto);
   }
 
   /**
    * DELETE /api/knowledge/entries/:slug
    * Soft delete an entry (sets status to ARCHIVED)
+   * Requires: ADMIN role or higher
    */
   @Delete(":slug")
+  @RequirePermission(Permission.WORKSPACE_ADMIN)
   async remove(
-    @Request() req: any,
-    @Param("slug") slug: string
+    @Workspace() workspaceId: string,
+    @Param("slug") slug: string,
+    @CurrentUser() user: any
   ) {
-    const workspaceId = req.user?.workspaceId;
-    const userId = req.user?.id;
-
-    if (!workspaceId || !userId) {
-      throw new UnauthorizedException("Authentication required");
-    }
-
-    await this.knowledgeService.remove(workspaceId, slug, userId);
+    await this.knowledgeService.remove(workspaceId, slug, user.id);
     return { message: "Entry archived successfully" };
   }
 }