- Add WorkspaceGuard to all widget data endpoints in WidgetsController - Use RequestWithWorkspace type for proper type safety (no non-null assertions) - Auto-detect workspace ID from localStorage in apiRequest when not explicitly provided, fixing all API calls missing X-Workspace-Id header - Replace hardcoded "default-workspace-id" in credentials pages with useWorkspaceId() hook Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>