Adopt Guest Workspace

Hand the workspace they have been playing in to the account they just made.

WHAT AUTH-LATER ACTUALLY COSTS, AND IT IS THIS ROUTE. Everything before it is real: the shop they picked, the record their agent wrote, the screen it drew, the call they heard. None of it is a demo to be thrown away and rebuilt once they sign in — the whole argument for postponing auth is that the work survives it.

TWO IDENTITIES, ON PURPOSE. The GUEST token authorises the handover (it proves the caller is the browser that has been holding this workspace) and the ACCOUNT token names the recipient. Requiring both is what stops a signed-in stranger adopting a workspace by guessing a team id, and what stops a guest token nominating an account it does not hold.

THE EXPIRY STOPS BEING DUE BY CONSTRUCTION. created_via becomes guest_adopted, and rehearsal.expire_workspace refuses any team whose created_via it does not recognise — so the queued four-hour job answers not_rehearsal and does nothing. The queued row is cancelled as well, but the metadata is the guarantee: a cancellation that failed to apply cannot delete a paying customer's tree.