Phase 6: Workspaces — Widget CRUD, Manager-Check, Cross-Tenant, Zustand Store, Settings Route

Backend:
- Widget CRUD: get_widgets, create_widget, update_widget, delete_widget
- Manager role check: is_workspace_manager
- Cross-tenant validation: verify_user_same_tenant (UserTenant)
- Default workspace seeding: seed_default_workspace with 12 standard modules
- Set user default workspace: set_user_default_workspace
- Fix create_workspace default uniqueness (unset others before insert)
- Widget CRUD routes: GET/POST/PUT/DELETE /{workspace_id}/widgets
- Set-default route: POST /{workspace_id}/set-default
- Cross-tenant validation in assign_user route

Frontend:
- workspaceStore (Zustand): central state with sessionStorage persistence
- API client interceptor: X-Workspace-ID header on all requests
- useWorkspace hook refactored to use workspaceStore
- Widget API hooks: useWorkspaceWidgets, useCreateWorkspaceWidget, etc.
- useSetDefaultWorkspace hook
- Settings route: /settings/workspaces with WorkspaceManagerPage
- Settings nav item for Workspaces

Tests:
- 25 backend tests (CRUD, modules, widgets, users, manager, seeding, context, isolation)
- 12 frontend tests (workspaceStore state, visibility, persistence, reset)
- 48/48 backend tests passing
- 12/12 frontend tests passing

app/routes/workspaces.py

@@ -228,6 +228,9 @@ async def assign_user(
         target_uid = uuid.UUID(body.user_id)
     except ValueError:
         raise HTTPException(400, detail={"detail": "Invalid ID", "code": "invalid_id"})
+    # Cross-tenant validation: target user must belong to same tenant
+    if not await workspace_service.verify_user_same_tenant(db, tenant_id, target_uid):
+        raise HTTPException(403, detail={"detail": "Cannot assign user from different tenant", "code": "cross_tenant"})
     return await workspace_service.assign_user(db, tenant_id, wid, target_uid, body.role, assigned_by=user_id)
 
 
@@ -248,3 +251,120 @@ async def remove_user(
     removed = await workspace_service.remove_user(db, tenant_id, wid, uid)
     if not removed:
         raise HTTPException(404, detail={"detail": "User not assigned to this workspace", "code": "not_found"})
+
+
+# ─── Widget CRUD ─────────────────────────────────────────────
+
+class WidgetCreate(BaseModel):
+    widget_key: str
+    position_x: int = 0
+    position_y: int = 0
+    width: int = 1
+    height: int = 1
+    config: dict[str, Any] = {}
+
+
+class WidgetUpdate(BaseModel):
+    position_x: int | None = None
+    position_y: int | None = None
+    width: int | None = None
+    height: int | None = None
+    config: dict[str, Any] | None = None
+
+
+@router.get("/{workspace_id}/widgets")
+async def list_widgets(
+    workspace_id: str,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(require_permission("workspaces:read")),
+):
+    """List all widgets for a workspace."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        wid = uuid.UUID(workspace_id)
+    except ValueError:
+        raise HTTPException(400, detail={"detail": "Invalid workspace_id", "code": "invalid_id"})
+    return {"items": await workspace_service.get_widgets(db, tenant_id, wid), "total": 0}
+
+
+@router.post("/{workspace_id}/widgets", status_code=status.HTTP_201_CREATED)
+async def create_widget(
+    workspace_id: str,
+    body: WidgetCreate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(require_permission("workspaces:configure_modules")),
+):
+    """Create a widget in a workspace. Multiple instances of the same widget_key allowed."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        wid = uuid.UUID(workspace_id)
+    except ValueError:
+        raise HTTPException(400, detail={"detail": "Invalid workspace_id", "code": "invalid_id"})
+    return await workspace_service.create_widget(
+        db, tenant_id, wid, body.widget_key,
+        body.position_x, body.position_y, body.width, body.height, body.config,
+    )
+
+
+@router.put("/{workspace_id}/widgets/{widget_id}")
+async def update_widget(
+    workspace_id: str,
+    widget_id: str,
+    body: WidgetUpdate,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(require_permission("workspaces:configure_modules")),
+):
+    """Update a widget."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        wid = uuid.UUID(widget_id)
+    except ValueError:
+        raise HTTPException(400, detail={"detail": "Invalid widget_id", "code": "invalid_id"})
+    result = await workspace_service.update_widget(
+        db, tenant_id, wid,
+        body.position_x, body.position_y, body.width, body.height, body.config,
+    )
+    if result is None:
+        raise HTTPException(404, detail={"detail": "Widget not found", "code": "not_found"})
+    return result
+
+
+@router.delete("/{workspace_id}/widgets/{widget_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_widget(
+    workspace_id: str,
+    widget_id: str,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(require_permission("workspaces:configure_modules")),
+):
+    """Delete a widget."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    try:
+        wid = uuid.UUID(widget_id)
+    except ValueError:
+        raise HTTPException(400, detail={"detail": "Invalid widget_id", "code": "invalid_id"})
+    deleted = await workspace_service.delete_widget(db, tenant_id, wid)
+    if not deleted:
+        raise HTTPException(404, detail={"detail": "Widget not found", "code": "not_found"})
+
+
+# ─── Set User Default Workspace ───────────────────────────────
+
+@router.post("/{workspace_id}/set-default", status_code=status.HTTP_200_OK)
+async def set_default_workspace(
+    workspace_id: str,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(require_permission("workspaces:read")),
+):
+    """Set a workspace as the current user's default."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    try:
+        wid = uuid.UUID(workspace_id)
+    except ValueError:
+        raise HTTPException(400, detail={"detail": "Invalid workspace_id", "code": "invalid_id"})
+    # Verify user is assigned to this workspace
+    ctx = await workspace_service.get_workspace_context(db, tenant_id, user_id, wid)
+    if ctx is None and not current_user.get("is_system_admin"):
+        raise HTTPException(403, detail={"detail": "Not assigned to this workspace", "code": "not_assigned"})
+    await workspace_service.set_user_default_workspace(db, tenant_id, user_id, wid)
+    return {"status": "ok", "workspace_id": workspace_id}