feat: harden workspace file APIs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/api/workspace_handler.go

@@ -31,6 +31,21 @@ func (h *workspaceHandler) create(c *gin.Context) {
 	c.JSON(http.StatusCreated, model.WorkspaceResponse{ID: ws.ID})
 }
 
+func (h *workspaceHandler) list(c *gin.Context) {
+	workspaces, err := h.svc.List()
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	resp := model.WorkspaceListResponse{
+		Workspaces: make([]model.WorkspaceResponse, 0, len(workspaces)),
+	}
+	for _, ws := range workspaces {
+		resp.Workspaces = append(resp.Workspaces, model.WorkspaceResponse{ID: ws.ID})
+	}
+	c.JSON(http.StatusOK, resp)
+}
+
 func (h *workspaceHandler) get(c *gin.Context) {
 	id := c.Param("id")
 	ws, err := h.svc.Get(id)