feat(#194): Fix workspace ID transmission mismatch between API and client

- Update WorkspaceGuard to support query string as fallback (backward compatibility)
- Priority order: Header > Param > Body > Query
- Update web client to send workspace ID via X-Workspace-Id header (recommended)
- Extend apiRequest helpers to accept workspace ID option
- Update fetchTasks to use header instead of query parameter
- Add comprehensive tests for all workspace ID transmission methods
- Tests passing: API 11 tests, Web 6 new tests (total 494)

This ensures consistent workspace ID handling with proper multi-tenant isolation
while maintaining backward compatibility with existing query string approaches.

Fixes #194

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/web/src/lib/api/tasks.ts

@@ -19,20 +19,19 @@ export interface TaskFilters {
 export async function fetchTasks(filters?: TaskFilters): Promise<Task[]> {
   const params = new URLSearchParams();
 
+  // Add filter parameters (not workspace ID - that goes in header)
   if (filters?.status) {
     params.append("status", filters.status);
   }
   if (filters?.priority) {
     params.append("priority", filters.priority);
   }
-  if (filters?.workspaceId) {
-    params.append("workspaceId", filters.workspaceId);
-  }
 
   const queryString = params.toString();
   const endpoint = queryString ? `/api/tasks?${queryString}` : "/api/tasks";
 
-  const response = await apiGet<ApiResponse<Task[]>>(endpoint);
+  // Pass workspaceId via header (X-Workspace-Id) instead of query string
+  const response = await apiGet<ApiResponse<Task[]>>(endpoint, filters?.workspaceId);
   return response.data;
 }