Record which workspace this user is acting in.

Their selection is stored on their row, so every later request resolves it from the credential instead of from a header the caller has to remember to send on each hop. Any member may select a workspace they belong to; this grants nothing, it only records which of their existing workspaces new resources should land in.

Membership is still re-checked on every request that uses it, so a stored selection cannot outlive the access it was based on.