List the workspaces the authenticated user belongs to.

A user-credential-only discovery op (no project_id). Use it, then list_projects, to resolve the project a subsequent request scopes to.

Args: request (Request): Incoming request (rate-limit plumbing). response (Response): Outgoing response (rate-limit plumbing). auth (AccountStampedAuth): Account-scope user auth (session token or CLI access JWT); carries the resolved user_id and stamps the per-user rate-limit identity.

Returns: PublicWorkspaceListResponse: The user's workspaces (id, name, role, is_demo); the public demo workspace, when present, comes last.