feat(auth): add workspace scope middleware and context

Introduces current-workspace context helpers plus a WorkspaceScope
middleware that validates X-Workspace-ID against workspace memberships,
defaulting to the actor's primary workspace. Prepares monitoring paths
to resolve quota/access-state per request workspace instead of per tenant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/auth/context_test.go

@@ -47,3 +47,31 @@ func TestActorCarriesPrimaryWorkspaceID(t *testing.T) {
 	assert.True(t, ok)
 	assert.Equal(t, int64(30), actor.PrimaryWorkspaceID)
 }
+
+func TestCurrentWorkspaceIDFallsBackToPrimaryWorkspace(t *testing.T) {
+	ctx := WithActor(context.Background(), Actor{
+		UserID:             10,
+		TenantID:           20,
+		PrimaryWorkspaceID: 30,
+		Role:               "member",
+	})
+
+	assert.Equal(t, int64(30), CurrentWorkspaceID(ctx))
+	_, ok := CurrentWorkspaceIDFromCtx(ctx)
+	assert.False(t, ok)
+}
+
+func TestCurrentWorkspaceIDUsesScopedWorkspace(t *testing.T) {
+	ctx := WithActor(context.Background(), Actor{
+		UserID:             10,
+		TenantID:           20,
+		PrimaryWorkspaceID: 30,
+		Role:               "member",
+	})
+	ctx = WithCurrentWorkspaceID(ctx, 40)
+
+	got, ok := CurrentWorkspaceIDFromCtx(ctx)
+	assert.True(t, ok)
+	assert.Equal(t, int64(40), got)
+	assert.Equal(t, int64(40), CurrentWorkspaceID(ctx))
+}