C Expand Batch 1: workspace registry CRUD + auth bootstrap

[BadGuyFranco]

Summary

• C-D1 (founder-ratified): GET /auth/session returns { csrfToken, bearerToken } with strict loopback Host required and Origin absent or loopback-only; 9 bootstrap regression tests.
• Workspace registry HTTP: GET/POST/PUT/DELETE /workspaces (+ GET /workspaces/:id) with Zod schemas in packages/schemas/src/oz/workspace-http.ts.
• CLI: cocoder oz register --id ID --workspace-root PATH (upsert semantics; tokenized paths via tokenizePath).
• Decision Log: C-D1..C-D4 captured in oz-mvp plan.

Test plan

• pnpm -r test — 322/322 (+20 from 302 baseline)
• C-S1..C-S9 security tests unchanged green
• New: oz-security-auth-bootstrap.test.mjs (C-D1)
• New: oz-workspaces-crud.test.mjs (registry CRUD + CLI register)
• cli-help-baseline.txt regenerated for oz register

Notes

• Batch 2 next: multiplexer-observer + runs API + real launch/stop subprocess.
• C-D1 threat-model amendment to be duplicated in docs/oz-security-checklist.md (Batch 4).

Made with Cursor