Phase 6: Workspaces — Widget CRUD, Manager-Check, Cross-Tenant, Zustand Store, Settings Route

Backend:
- Widget CRUD: get_widgets, create_widget, update_widget, delete_widget
- Manager role check: is_workspace_manager
- Cross-tenant validation: verify_user_same_tenant (UserTenant)
- Default workspace seeding: seed_default_workspace with 12 standard modules
- Set user default workspace: set_user_default_workspace
- Fix create_workspace default uniqueness (unset others before insert)
- Widget CRUD routes: GET/POST/PUT/DELETE /{workspace_id}/widgets
- Set-default route: POST /{workspace_id}/set-default
- Cross-tenant validation in assign_user route

Frontend:
- workspaceStore (Zustand): central state with sessionStorage persistence
- API client interceptor: X-Workspace-ID header on all requests
- useWorkspace hook refactored to use workspaceStore
- Widget API hooks: useWorkspaceWidgets, useCreateWorkspaceWidget, etc.
- useSetDefaultWorkspace hook
- Settings route: /settings/workspaces with WorkspaceManagerPage
- Settings nav item for Workspaces

Tests:
- 25 backend tests (CRUD, modules, widgets, users, manager, seeding, context, isolation)
- 12 frontend tests (workspaceStore state, visibility, persistence, reset)
- 48/48 backend tests passing
- 12/12 frontend tests passing

frontend/src/hooks/useWorkspace.ts

@@ -1,70 +1,76 @@
-import { useState, useEffect, useCallback } from 'react';
-import { useMyWorkspaces, useWorkspaceContext, type WorkspaceContext } from '@/api/hooks/workspaces';
+import { useEffect, useCallback } from 'react';
+import { useMyWorkspaces, useWorkspaceContext } from '@/api/hooks/workspaces';
+import { useWorkspaceStore, type WorkspaceInfo, type WorkspaceContextState } from '@/store/workspaceStore';
 import { useAuthStore } from '@/store/authStore';
 
-const STORAGE_KEY = 'leocrm-active-workspace';
-
 /**
  * Manages the active workspace for the current browser tab.
  *
- * Uses sessionStorage (per-tab, not shared across tabs) to store the active workspace ID.
- * Sends X-Workspace-ID header on workspace-aware requests.
+ * Uses the central workspaceStore (Zustand) for state management.
+ * sessionStorage provides per-tab persistence.
+ * X-Workspace-ID header is sent automatically by the API client interceptor.
  *
  * Workspaces are UI/navigation context only — they never affect permissions.
  */
 export function useWorkspace() {
-  const [activeWorkspaceId, setActiveWorkspaceId] = useState<string | null>(() => {
-    return sessionStorage.getItem(STORAGE_KEY);
-  });
+  const activeWorkspaceId = useWorkspaceStore(s => s.activeWorkspaceId);
+  const context = useWorkspaceStore(s => s.context);
+  const myWorkspacesFromStore = useWorkspaceStore(s => s.myWorkspaces);
+  const setActiveWorkspace = useWorkspaceStore(s => s.setActiveWorkspace);
+  const setContext = useWorkspaceStore(s => s.setContext);
+  const setMyWorkspaces = useWorkspaceStore(s => s.setMyWorkspaces);
+  const isModuleVisibleFromStore = useWorkspaceStore(s => s.isModuleVisible);
 
-  const { data: myWorkspaces } = useMyWorkspaces();
-  const { data: context } = useWorkspaceContext(activeWorkspaceId);
+  const user = useAuthStore.getState().user;
+  const isSystemAdmin = user?.is_system_admin;
+
+  // Fetch my workspaces and sync to store
+  const { data: myWorkspacesData } = useMyWorkspaces();
+  const { data: contextData } = useWorkspaceContext(activeWorkspaceId);
+
+  // Sync fetched workspaces to store
+  useEffect(() => {
+    if (myWorkspacesData?.items) {
+      setMyWorkspaces(myWorkspacesData.items as WorkspaceInfo[]);
+    }
+  }, [myWorkspacesData, setMyWorkspaces]);
+
+  // Sync fetched context to store
+  useEffect(() => {
+    if (contextData !== undefined) {
+      setContext(contextData as WorkspaceContextState | null);
+    }
+  }, [contextData, setContext]);
 
   // Auto-select default workspace if none selected
   useEffect(() => {
-    if (!activeWorkspaceId && myWorkspaces?.items?.length) {
-      const defaultWs = myWorkspaces.items.find(w => w.is_user_default) || myWorkspaces.items[0];
+    if (!activeWorkspaceId && myWorkspacesData?.items?.length) {
+      const defaultWs = myWorkspacesData.items.find(w => w.is_user_default) || myWorkspacesData.items[0];
       if (defaultWs) {
-        setActiveWorkspaceId(defaultWs.id);
-        sessionStorage.setItem(STORAGE_KEY, defaultWs.id);
+        setActiveWorkspace(defaultWs.id);
       }
     }
-  }, [activeWorkspaceId, myWorkspaces]);
+  }, [activeWorkspaceId, myWorkspacesData, setActiveWorkspace]);
 
   // Switch workspace (per-tab)
   const switchWorkspace = useCallback((workspaceId: string | null) => {
-    if (workspaceId) {
-      sessionStorage.setItem(STORAGE_KEY, workspaceId);
-    } else {
-      sessionStorage.removeItem(STORAGE_KEY);
-    }
-    setActiveWorkspaceId(workspaceId);
-  }, []);
-
-  // Get visible module keys from workspace context
-  const visibleModuleKeys: Set<string> = new Set(
-    context?.modules?.map(m => m.module_key) || []
-  );
+    setActiveWorkspace(workspaceId);
+  }, [setActiveWorkspace]);
 
   // Check if a module is visible in the current workspace
   const isModuleVisible = useCallback((moduleKey: string): boolean => {
-    // System admins see all modules regardless of workspace
-    const user = useAuthStore.getState().user;
-    if (user?.is_system_admin) return true;
-    // While permissions are loading (is_system_admin undefined), show everything
-    if (user && user.is_system_admin === undefined) return true;
-    // If no workspace context, show all (backward compatible)
-    if (!context?.workspace_id || !context?.modules?.length) return true;
-    return visibleModuleKeys.has(moduleKey);
-  }, [context, visibleModuleKeys]);
+    return isModuleVisibleFromStore(moduleKey, isSystemAdmin);
+  }, [isModuleVisibleFromStore, isSystemAdmin]);
+
+  const visibleModuleKeys = useWorkspaceStore(s => s.visibleModuleKeys());
 
   return {
     activeWorkspaceId,
     activeWorkspace: context,
-    myWorkspaces: myWorkspaces?.items || [],
+    myWorkspaces: myWorkspacesFromStore,
     switchWorkspace,
     isModuleVisible,
     visibleModuleKeys,
-    hasWorkspaces: (myWorkspaces?.items?.length || 0) > 0,
+    hasWorkspaces: myWorkspacesFromStore.length > 0,
   };
 }