Take the template this workspace signed up for

Return the public-gallery template slug stashed on the workspace at sign-up, and REMOVE it in the same call. A POST because it is a take, not a read: the browser-side stash is per-tab sessionStorage, so the verification-email path (which opens a new tab) has nothing left to carry the intent, and this is what replaces it. One-shot by construction — the second caller, and every later landing, gets null, so an arrival that was refused, errored, or abandoned can never re-fire. Deliberately NOT gated on the dashboards-v3 flag: a workspace without the flag still has to be able to clear a slug it can no longer use.