feat(#194): Fix workspace ID transmission mismatch between API and client

- Update WorkspaceGuard to support query string as fallback (backward compatibility)
- Priority order: Header > Param > Body > Query
- Update web client to send workspace ID via X-Workspace-Id header (recommended)
- Extend apiRequest helpers to accept workspace ID option
- Update fetchTasks to use header instead of query parameter
- Add comprehensive tests for all workspace ID transmission methods
- Tests passing: API 11 tests, Web 6 new tests (total 494)

This ensures consistent workspace ID handling with proper multi-tenant isolation
while maintaining backward compatibility with existing query string approaches.

Fixes #194

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/common/guards/workspace.guard.ts

@@ -30,11 +30,12 @@ import type { AuthenticatedRequest } from "../types/user.types";
  * ```
  *
  * The workspace ID can be provided via:
- * - Header: `X-Workspace-Id`
+ * - Header: `X-Workspace-Id` (recommended)
  * - URL parameter: `:workspaceId`
  * - Request body: `workspaceId` field
+ * - Query parameter: `?workspaceId=xxx` (backward compatibility)
  *
- * Priority: Header > Param > Body
+ * Priority: Header > Param > Body > Query
  *
  * Note: RLS context must be set at the service layer using withUserContext()
  * or withUserTransaction() to ensure proper transaction scoping with connection pooling.
@@ -58,7 +59,7 @@ export class WorkspaceGuard implements CanActivate {
 
     if (!workspaceId) {
       throw new BadRequestException(
-        "Workspace ID is required (via header X-Workspace-Id, URL parameter, or request body)"
+        "Workspace ID is required (via header X-Workspace-Id, URL parameter, request body, or query string)"
       );
     }
 
@@ -89,18 +90,19 @@ export class WorkspaceGuard implements CanActivate {
 
   /**
    * Extracts workspace ID from request in order of priority:
-   * 1. X-Workspace-Id header
+   * 1. X-Workspace-Id header (recommended)
    * 2. :workspaceId URL parameter
    * 3. workspaceId in request body
+   * 4. workspaceId query parameter (for backward compatibility)
    */
   private extractWorkspaceId(request: AuthenticatedRequest): string | undefined {
-    // 1. Check header
+    // 1. Check header (recommended approach)
     const headerWorkspaceId = request.headers["x-workspace-id"];
     if (typeof headerWorkspaceId === "string") {
       return headerWorkspaceId;
     }
 
-    // 2. Check URL params
+    // 2. Check URL params (:workspaceId in route)
     const paramWorkspaceId = request.params.workspaceId;
     if (paramWorkspaceId) {
       return paramWorkspaceId;
@@ -112,6 +114,14 @@ export class WorkspaceGuard implements CanActivate {
       return bodyWorkspaceId;
     }
 
+    // 4. Check query string (backward compatibility for existing clients)
+    // Access query property if it exists (may not be in all request types)
+    const requestWithQuery = request as typeof request & { query?: Record<string, unknown> };
+    const queryWorkspaceId = requestWithQuery.query?.workspaceId;
+    if (typeof queryWorkspaceId === "string") {
+      return queryWorkspaceId;
+    }
+
     return undefined;
   }