feat(server): workspace restore + deleted-list endpoints (TASK-1970)

[xarmian]

What

Backend foundation for PLAN-1969 (user-recoverable workspace soft-delete). Adds the store methods, HTTP endpoints, CLI client methods, and TS type needed to restore a soft-deleted workspace and list the ones still inside the recovery window. No product-behavior change beyond adding restore/list.

Store (internal/store/workspaces.go):

• RestoreWorkspace(slug) — UPDATE workspaces SET deleted_at = NULL WHERE slug=? AND deleted_at IS NOT NULL; returns sql.ErrNoRows (→ 404) when nothing soft-deleted matched. Inverse of DeleteWorkspace.
• ListDeletedWorkspaces(userID, cutoff) — owner-scoped (owner_id = ?), deleted_at within the window, ordered deleted_at DESC.
• GetDeletedWorkspaceBySlug(slug) — resolves a soft-deleted row (the normal resolvers filter deleted_at IS NULL) so the handler can tell 403 from 404.
• Dual-dialect (s.q / s.dialect); no migration (deleted_at already exists).

Handlers (internal/server/handlers_workspaces.go):

• POST /api/v1/workspaces/{slug}/restore — owner-only. 200 + restored workspace on success; 403 for a live-owned non-owner; 404 for live/unknown/past-horizon/owner-gone. Logs a restored activity + publishes WorkspaceUpdated.
• GET /api/v1/workspaces/deleted — owner-scoped list; each entry carries deleted_at, purge_at, and days_left.
• Both routed outside the /{slug} RequireWorkspaceAccess subrouter (that middleware resolves only live workspaces and would 404 a soft-deleted one); restore enforces owner authz inline.

CLI client (internal/cli/client.go): RestoreWorkspace(slug) + ListDeletedWorkspaces() (T3/CLI depend on these).
TS type (web/src/lib/types/index.ts): Workspace.deleted_at + DeletedWorkspace (purge_at, days_left). Web api.workspaces methods land in TASK-1971.

Why

The 30-day soft-delete purge window (TASK-1966) is now user-recoverable. Restore + the deleted-list share one window — both derive it from Server.effectivePurgeRetention() (the sweeper's overridable workspacePurgeRetention), so "N days left" never drifts from the real purge horizon.

Notes

• A workspace delete only stamps workspaces.deleted_at; items/collections/members are untouched and hidden transitively, so restore re-surfaces everything intact (proven by a store test).
• Account-deleted workspaces have no live owner, so they never appear in the list and can't be restored/probed by slug (owner-gone → 404, not 403).

Testing

• Store tests: resurface-intact; double-restore/live → ErrNoRows; window boundary (29d IN / 31d OUT) + owner-scoping + DESC ordering.
• Handler tests: owner restore 200; non-owner 403; live/unknown 404; past-horizon 404; owner-gone 404 (no slug probe); zero-user no-bypass; owner-scoped deleted-list with purge_at/days_left.
• Gates: golangci-lint run ./... clean, go build ./..., go test ./... (SQLite), and make test-pg (Postgres :5445) — all green. Codex review: CLEAN.

Closes TASK-1970

https://claude.ai/code/session_01HxBkAMiFBtCRJ2tKSCt3ST