Get Workspace Hotspots

Merged worst-N churn hotspots across every member repo.

The view used to fan out one uncached per-member getHotspots call from the browser; this rolls the same per-member git_metadata.json derivation up server-side. Hotspots aren't a precomputed workspace artifact — each member's are derived from its own git metadata (same filter + translation as the single-repo /snapshots/{id}/hotspots route) and merged here.

Authz mirrors the sibling artifact endpoints (cross-user → 404). It reads the member snapshots this workspace snapshot froze, re-authorised for the caller, so the merge is immutable per (snapshot, readable members) and limit just slices it.