P1: Workspace tenancy + signed-token authn (no header trust)

[gnanirahulnutakki]

Phase 1. Implement the Workspace tenancy anchor and signed-token authn — authorization derives from signed token claims only, never request headers.

Tasks

• Workspace + Membership (roles: reader/operator/approver/admin) data model
• Session/token verification; tenant + role from memberships[workspace] claim
• Strip/ignore any inbound x-*-role/x-*-tenant headers
• App-layer tenant scoping on every workspace-scoped model (hard-fail on mismatch)

Acceptance

• A header-injected role has no effect; identity/tenant come only from the signed token.

Refs: ADR-0003, THREAT-MODEL §7.

[gnanirahulnutakki]

Delivered by PR #75 and merged to dev as 81fd793. Local make ci, manual repository-native red-team review, and the pinned real kind multi-cluster gate passed. PR CI run 29175976225 and post-merge dev CI run 29176136498 both completed successfully, including vulnerability scan, race tests, SBOM/reproducibility, and real two-cluster fan-out. Codex Security MCP was intentionally skipped per operator direction because its stale UI resource was unavailable. Follow-ons remain #8 for forced PostgreSQL RLS and #12 for the destructive tenant-isolation suite.