feat(gateway): WorkspaceService + ProjectBootstrapService + TeamsService (P8-015)

- WorkspaceService: path resolution, git init/clone, directory lifecycle (create/delete/exists), user and team root provisioning
- ProjectBootstrapService: orchestrates DB record creation (via Brain) + workspace directory init in a single call
- TeamsService: isMember, canAccessProject, findAll, findById, listMembers via Drizzle DB queries
- WorkspaceController: POST /api/workspaces — auth-guarded project bootstrap endpoint
- TeamsController: GET /api/teams, /:teamId, /:teamId/members, /:teamId/members/:userId
- WorkspaceModule wired into AppModule
- workspace.service.spec.ts: 5 unit tests for resolvePath (user, team, fallback, env var, default)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/gateway/src/workspace/workspace.controller.ts

@@ -0,0 +1,30 @@
+import { Body, Controller, Post, UseGuards } from '@nestjs/common';
+import { AuthGuard } from '../auth/auth.guard.js';
+import { CurrentUser } from '../auth/current-user.decorator.js';
+import { ProjectBootstrapService } from './project-bootstrap.service.js';
+
+@Controller('api/workspaces')
+@UseGuards(AuthGuard)
+export class WorkspaceController {
+  constructor(private readonly bootstrap: ProjectBootstrapService) {}
+
+  @Post()
+  async create(
+    @CurrentUser() user: { id: string },
+    @Body()
+    body: {
+      name: string;
+      description?: string;
+      teamId?: string;
+      repoUrl?: string;
+    },
+  ) {
+    return this.bootstrap.bootstrap({
+      name: body.name,
+      description: body.description,
+      userId: user.id,
+      teamId: body.teamId,
+      repoUrl: body.repoUrl,
+    });
+  }
+}