Add requireAuth middleware to unprotected API routes

[kopahead]

Problem

Several API route modules are missing requireAuth middleware, making them publicly accessible without authentication:

• src/routes/workspaces.ts — workspace CRUD, dashboard, activity
• src/routes/conversations.ts — conversation list, detail, close
• src/routes/connectors.ts — MCP + consumer connector management
• src/routes/query.ts — agent loop entry point

Only src/routes/org.ts and src/routes/queues.ts currently apply requireAuth.

Impact

Any unauthenticated request can list workspaces, read conversations, manage connectors, and trigger AI queries.

Fix

Add requireAuth middleware to each unprotected route module, following the pattern in src/routes/org.ts:

import { requireAuth, type AuthUser, type AuthEnv } from '../middleware/auth.js'

workspaces.use('/api/workspaces/*', requireAuth)
workspaces.use('/api/workspaces', requireAuth)

Files

• src/routes/workspaces.ts
• src/routes/conversations.ts
• src/routes/connectors.ts
• src/routes/query.ts