feat(provenant-api): workspace + key provisioning endpoints

- POST /v1/setup — bootstrap workspace, project, first API key (no auth)
- GET /v1/workspaces/:id — workspace details with members/projects/keys
- POST /v1/workspaces/:id/keys — create additional API keys
- POST /v1/workspaces/:id/members — invite with seat limit enforcement
- Migration v2: workspaces, workspace_members, projects tables
- API keys now linked to workspace_id
- Deployed to CF Workers, Neon migration applied
- Add .dev.vars to .gitignore

Author: StackMemory Bot (CLI)

.gitignore

@@ -21,6 +21,7 @@ out/
 .env.production
 .env.development
 .env.linear
+.dev.vars
 
 # IDE & Editor
 .vscode/
@@ -80,6 +81,10 @@ ENV/
 target/
 Cargo.lock
 
+# Swift
+.build/
+**/.build/
+
 # Go
 *.test
 *.out

packages/provenant-api/src/auth.js

@@ -28,7 +28,7 @@ export async function authenticate(request, env, sql, responseHeaders = {}) {
   const keyHash = createHash('sha256').update(token).digest('hex');
 
   const rows = await sql`
-    SELECT id, user_email, project_id FROM api_keys
+    SELECT id, user_email, project_id, workspace_id FROM api_keys
     WHERE key_hash = ${keyHash}
       AND revoked_at IS NULL
   `;
@@ -47,5 +47,9 @@ export async function authenticate(request, env, sql, responseHeaders = {}) {
     () => {}
   );
 
-  return { projectId: key.project_id, email: key.user_email };
+  return {
+    projectId: key.project_id,
+    workspaceId: key.workspace_id,
+    email: key.user_email,
+  };
 }