Create a workspace administered by the authenticated user.

Idempotent: re-creating a workspace the user already administers under the same name returns that workspace with created: false.

Args: request (Request): Incoming request (rate-limit plumbing). response (Response): Outgoing response (rate-limit plumbing). auth (AccountStampedAuth): Account-scope user auth (session token or CLI access JWT); its resolved user_id becomes the actor. payload (CreateWorkspaceRequest): The workspace to create. _live (None): Write-path liveness gate (blocks a revoked JWT session).

Returns: CreateWorkspaceResponse: The created (or matched) workspace.