feat(#194): Fix workspace ID transmission mismatch between API and client

- Update WorkspaceGuard to support query string as fallback (backward compatibility)
- Priority order: Header > Param > Body > Query
- Update web client to send workspace ID via X-Workspace-Id header (recommended)
- Extend apiRequest helpers to accept workspace ID option
- Update fetchTasks to use header instead of query parameter
- Add comprehensive tests for all workspace ID transmission methods
- Tests passing: API 11 tests, Web 6 new tests (total 494)

This ensures consistent workspace ID handling with proper multi-tenant isolation
while maintaining backward compatibility with existing query string approaches.

Fixes #194

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/web/src/lib/api/client.test.ts

@@ -100,6 +100,26 @@ describe("API Client", (): void => {
       );
       expect(result).toEqual(mockData);
     });
+
+    it("should include workspace ID in header when provided", async (): Promise<void> => {
+      const mockData = { id: "1" };
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve(mockData),
+      });
+
+      await apiGet<typeof mockData>("/test", "workspace-123");
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "http://localhost:3001/test",
+        expect.objectContaining({
+          method: "GET",
+          headers: expect.objectContaining({
+            "X-Workspace-Id": "workspace-123",
+          }),
+        })
+      );
+    });
   });
 
   describe("apiPost", (): void => {
@@ -143,6 +163,26 @@ describe("API Client", (): void => {
       const callArgs = mockFetch.mock.calls[0]![1] as RequestInit;
       expect(callArgs.body).toBeUndefined();
     });
+
+    it("should include workspace ID in header when provided", async (): Promise<void> => {
+      const postData = { name: "New Item" };
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: () => Promise.resolve({}),
+      });
+
+      await apiPost("/test", postData, "workspace-456");
+
+      expect(mockFetch).toHaveBeenCalledWith(
+        "http://localhost:3001/test",
+        expect.objectContaining({
+          method: "POST",
+          headers: expect.objectContaining({
+            "X-Workspace-Id": "workspace-456",
+          }),
+        })
+      );
+    });
   });
 
   describe("apiPatch", (): void => {