feat(N1): Scope-Registry via Contract — workspace_scopes() Deklarationen + /scope-definitions Endpoint (#365)

- workspace_scopes() Contract-Hook (document_placeholders-Muster): Plugins deklarieren Scope-Dimensionen inkl. Wertequellen
- Deklarationen: contacts (Ordner/Typen/Saved-View), dms (Ordner/Datei-Typen), mail (Postfächer), calendar (Kalender/Standard-Ansicht)
- Pydantic fail-closed (schemas/workspace.py): ScopeOption, ScopeValueSource (nur interne /api/v1-Pfade, SSRF-sicher), WorkspaceScopeDimension, WorkspaceModuleScopes
- Aggregator workspace_scope_service.py: discovered-Plugins, ARCH-014-safe, Crash-sicher, ungültige Deklarationen verworfen
- GET /api/v1/workspaces/scope-definitions (workspaces:configure_modules) vor /{workspace_id} registriert
- Security-Invariante: Scope = reine UND-Einschränkung (Workspace ∧ RLS ∧ ABAC ∧ Permissions)
- Tests: 18/18 neu (TDD rot→grün), Regression 17/17, Checker 0 Verstöße, Ruff clean
- Doku: api-documentation.md Workspaces-Sektion, PROGRESS.md Phase N1

docs/api-documentation.md

@@ -296,6 +296,29 @@ Personal per-user dashboards (Phase M2). Owner-only: every query is scoped to te
 | DELETE | `/api/v1/dashboards/{id}` | Soft-delete (deleting the default promotes the next one). |
 | POST | `/api/v1/dashboards/{id}/set-default` | Mark as the user's default (exactly one). |
 
+### workspaces (14 endpoints)
+
+Workspaces are UI/navigation context only — they never affect permissions or data access (Phase N). Visibility is always Workspace ∧ RLS ∧ ABAC ∧ Permissions. Tab-local workspace selection via `X-Workspace-ID` header; the API client interceptor sets it per tab. Requires `workspaces:*` core permissions.
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/v1/workspaces` | List all workspaces for the tenant. |
+| POST | `/api/v1/workspaces` | Create workspace (creator becomes manager; only one default per tenant). |
+| GET | `/api/v1/workspaces/my` | Workspaces assigned to the current user. |
+| GET | `/api/v1/workspaces/context` | Active workspace context (modules + widgets) — X-Workspace-ID header, falls back to user default. |
+| GET | `/api/v1/workspaces/scope-definitions` | N1: aggregated `workspace_scopes()` contract contributions — per module_key the filterable scope dimensions (control type, options, value_source) for the workspace editor. Admin (`workspaces:configure_modules`). |
+| GET | `/api/v1/workspaces/{id}` | Get one workspace with modules and user count. |
+| PUT | `/api/v1/workspaces/{id}` | Update workspace. |
+| DELETE | `/api/v1/workspaces/{id}` | Soft-delete workspace (is_active=false). |
+| POST | `/api/v1/workspaces/{id}/modules` | Replace module assignments (module_key, is_visible, menu_order, config — config JSONB stores Phase N scope values). |
+| POST | `/api/v1/workspaces/{id}/users` | Assign user (member/manager, same-tenant check). |
+| DELETE | `/api/v1/workspaces/{id}/users/{user_id}` | Remove user assignment. |
+| GET | `/api/v1/workspaces/{id}/widgets` | List workspace widgets (multiple instances of same key allowed). |
+| POST | `/api/v1/workspaces/{id}/widgets` | Create widget (position, size, config). |
+| PUT | `/api/v1/workspaces/{id}/widgets/{widget_id}` | Update widget. |
+| DELETE | `/api/v1/workspaces/{id}/widgets/{widget_id}` | Delete widget. |
+| POST | `/api/v1/workspaces/{id}/set-default` | Set as the current user's default workspace. |
+
 ---
 
 ## Plugin Routes