feat(gateway): WorkspaceService + ProjectBootstrapService + TeamsService (P8-015)

- WorkspaceService: path resolution, git init/clone, directory lifecycle (create/delete/exists), user and team root provisioning
- ProjectBootstrapService: orchestrates DB record creation (via Brain) + workspace directory init in a single call
- TeamsService: isMember, canAccessProject, findAll, findById, listMembers via Drizzle DB queries
- WorkspaceController: POST /api/workspaces — auth-guarded project bootstrap endpoint
- TeamsController: GET /api/teams, /:teamId, /:teamId/members, /:teamId/members/:userId
- WorkspaceModule wired into AppModule
- workspace.service.spec.ts: 5 unit tests for resolvePath (user, team, fallback, env var, default)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/gateway/src/workspace/teams.controller.ts

@@ -0,0 +1,30 @@
+import { Controller, Get, Param, UseGuards } from '@nestjs/common';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { TeamsService } from './teams.service.js';
+
+@Controller('api/teams')
+@UseGuards(AuthGuard)
+export class TeamsController {
+  constructor(private readonly teams: TeamsService) {}
+
+  @Get()
+  async list() {
+    return this.teams.findAll();
+  }
+
+  @Get(':teamId')
+  async findOne(@Param('teamId') teamId: string) {
+    return this.teams.findById(teamId);
+  }
+
+  @Get(':teamId/members')
+  async listMembers(@Param('teamId') teamId: string) {
+    return this.teams.listMembers(teamId);
+  }
+
+  @Get(':teamId/members/:userId')
+  async checkMembership(@Param('teamId') teamId: string, @Param('userId') userId: string) {
+    const isMember = await this.teams.isMember(teamId, userId);
+    return { isMember };
+  }
+}