#9607 improvement(workspaces): move workspace updates behind an application operation and let Chat rename workspaces

Summary

• PATCH/PUT /api/workspaces/[id] queried the DB and decided authorization in the route; it now runs through workspaces.update (admin, session-only, workspace keys denied) on the shared internal route builder
• Chat could not rename a workspace. New workspaces.identity.update (admin, Copilot-delegated, sim:settings) accepts only name and logoUrl via a strict pick, so billedAccountUserId and allowPersonalApiKeys are rejected; exposed as a settings workspace/general section with a workspaces.identity.read read
• Route behavior preserved: same order, 403 Insufficient permissions for non-admin/non-member/archived, billed-account 400s, payer transfer in the transaction, WORKSPACE_UPDATED audit with the same changes metadata. Differences from the shared builder: error bodies carry requestId, response is contract-validated, and a row vanishing mid-request returns 404 instead of an empty 200
• No approval gates added

Type of Change

• Improvement

Testing

• New update-workspace.integration.ts (real Postgres, real route and settings tool): 11/11; each guard reverted alone turns its case red (identity role lowered, identity schema widened, delegated principals admitted to full update, 403 mapping removed)
• settings.test.ts, settings-management-boundary.test.ts (30), copilot-route-inventory.test.ts
• bun run lint, check:api-validation:strict, check:boundaries, check:route-verbs, check:api-contract-routes, check:principal-kind-parity, check:application-graph, check:permission-group-enforcement, check:test-types, pre-push type-check

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)