List Mine

List the caller's workspaces.

Phase 2 wiring (EPIC #114): on first call this lazily creates the user's "Personal" workspace via ensure_personal_workspace. We chose lazy-on-list rather than a global request middleware because:

1. It only runs for endpoints that already resolve a user_id, so OAuth flows and health probes are untouched.
2. The frontend always hits /api/workspaces to render the switcher on dashboard load, so the latency cost is amortised.
3. ensure_personal_workspace is idempotent and race-safe (it checks for an existing Personal workspace by name+owner before inserting), so multiple concurrent requests converge to one row.