- Add WorkspaceGuard to all widget data endpoints in WidgetsController
- Use RequestWithWorkspace type for proper type safety (no non-null assertions)
- Auto-detect workspace ID from localStorage in apiRequest when not
explicitly provided, fixing all API calls missing X-Workspace-Id header
- Replace hardcoded "default-workspace-id" in credentials pages with
useWorkspaceId() hook
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>