Get-or-create a workspace (idempotent)

Idempotent counterpart to POST /api/workspaces, reachable with a plain write-scoped API key instead of an admin JWT — the only path a programmatic caller (the Claude Code plugin's HTTP MCP surface, ctx_workspace_ensure) has to provision its own workspace. Resolves an existing, non-tombstoned workspace inside the caller's tenant by slug when given, else by the slugified name, and returns it with created: false; otherwise creates one and returns created: true. workspaces.slug is globally unique among non-deleted rows, so a created workspace may receive a suffixed slug that differs from the requested one — callers must persist the slug from this response rather than re-deriving it.