Phase 3C — Commit Summary

feat: workspaces — collaborative repo namespaces
Backend
- internal/models/workspace.go — Workspace (handle, displayName,
  description, createdBy) + WorkspaceMember (workspaceId, userId,
  username, role: owner/admin/member)
- internal/models/repo.go — added nullable workspace_id column; existing
  user repos unaffected
- internal/models/migrations/011_workspaces.go — syncs both tables +
  adds column to repository
- internal/api/handlers/workspace.go — ListWorkspaces, CreateWorkspace,
  GetWorkspace, UpdateWorkspace, DeleteWorkspace (blocks if repos
  remain), ListRepos, ListMembers, AddMember, UpdateMember, RemoveMember
- internal/api/handlers/repos.go — lookupRepo resolves workspace
  handles; Create accepts workspace field; List includes workspace
  member repos; withOwnerName uses workspace handle for workspace-owned
  repos
- internal/api/handlers/dashboard.go — recentRuns + repo list include
  workspace repos the user is a member of
- internal/api/router.go — /workspaces, /workspaces/:handle/* routes
  Workspace rules enforced:
- Handle globally unique across usernames + workspace handles (409 on
  collision)
- Creator auto-assigned owner role
- Delete blocked if repos exist
- Last owner cannot be demoted/removed
  ---
  feat: secret management hierarchy (Global → Workspace → Repo → Env)
  Backend
- internal/models/secret.go — Secret struct +
  EncryptSecret/DecryptSecret with AES-256-GCM (key = SHA-256 of
  SESSION_SECRET); values never serialised to JSON
- internal/models/migrations/012_secrets.go — syncs secret table
- internal/api/handlers/secret.go — List/Upsert/Delete for all four
  scopes; ResolveSecretsForRun builds merged env map for CI
- internal/domain/ci/executor.go — JobContext.Secrets field; secrets
  injected as --env KEY=VALUE into docker run; buildJobContext calls
  resolveSecrets(Global < Workspace < Repo < Env)
- internal/domain/ci/runner_manager.go — passes cfg.SessionSecret to
  buildJobContext
- internal/api/router.go — /repos/:owner/:repo/secrets,
  /environments/:envName/secrets, /workspaces/:handle/secrets,
  /admin/secrets
  ---
  feat: workspace + secret management UI
  Frontend
- types/api.ts — Workspace, WorkspaceWithMeta, WorkspaceMember,
  SecretListItem types
- api/queries/workspaces.ts — full CRUD hooks + WorkspaceRepo type
- api/queries/secrets.ts — repo/env/workspace secret hooks
- pages/WorkspacesPage.tsx — list + create modal
- pages/WorkspacePage.tsx — workspace dashboard with repo list
- pages/WorkspaceSettingsPage.tsx — general settings, members CRUD,
  workspace secrets, danger zone
- pages/RepoSecretsPage.tsx — repo secrets + per-environment secret
  sections with priority hierarchy callout
- pages/CreateRepoPage.tsx — ?workspace= query param pre-fills owner
  selector; only admin/owner workspaces shown
- components/layout/Sidebar.tsx — "Workspaces" global nav item +
  workspace quick-links; "Secrets" in RepoSubNav; new SecretsIcon,
  WorkspaceIcon
- App.tsx — routes for /workspaces, /workspaces/:handle,
  /workspaces/:handle/settings, /repos/:owner/:repo/secrets

frontend/src/App.tsx

@@ -37,8 +37,12 @@ const PRsPage           = lazy(() => import('./pages/PRsPage'))
 const PipelinesPage     = lazy(() => import('./pages/PipelinesPage'))
 const PipelineRunPage      = lazy(() => import('./pages/PipelineRunPage'))
 const RepoPipelinesPage    = lazy(() => import('./pages/RepoPipelinesPage'))
-const EnvironmentsPage     = lazy(() => import('./pages/EnvironmentsPage'))
-const RepoTimelinePage     = lazy(() => import('./pages/RepoTimelinePage'))
+const EnvironmentsPage        = lazy(() => import('./pages/EnvironmentsPage'))
+const RepoTimelinePage        = lazy(() => import('./pages/RepoTimelinePage'))
+const RepoSecretsPage         = lazy(() => import('./pages/RepoSecretsPage'))
+const WorkspacesPage          = lazy(() => import('./pages/WorkspacesPage'))
+const WorkspacePage           = lazy(() => import('./pages/WorkspacePage'))
+const WorkspaceSettingsPage   = lazy(() => import('./pages/WorkspaceSettingsPage'))
 const ProfilePage       = lazy(() => import('./pages/ProfilePage'))
 const ExplorePage       = lazy(() => import('./pages/ExplorePage'))
 const SettingsPage      = lazy(() => import('./pages/SettingsPage'))
@@ -89,11 +93,15 @@ export default function App() {
               <Route path="repos/:owner/:repo/pipelines"           element={<S><RepoPipelinesPage /></S>} />
               <Route path="repos/:owner/:repo/environments"        element={<S><EnvironmentsPage /></S>} />
               <Route path="repos/:owner/:repo/timeline"           element={<S><RepoTimelinePage /></S>} />
+              <Route path="repos/:owner/:repo/secrets"            element={<S><RepoSecretsPage /></S>} />
               <Route path="repos/:owner/:repo/runs/:runId"         element={<S><PipelineRunPage /></S>} />
 
               <Route path="starred"   element={<S><StarredPage /></S>} />
               <Route path="pulls"     element={<S><PRsPage /></S>} />
               <Route path="pipelines" element={<S><PipelinesPage /></S>} />
+              <Route path="workspaces" element={<S><WorkspacesPage /></S>} />
+              <Route path="workspaces/:handle" element={<S><WorkspacePage /></S>} />
+              <Route path="workspaces/:handle/settings" element={<S><WorkspaceSettingsPage /></S>} />
               <Route path="explore"   element={<S><ExplorePage /></S>} />
               <Route path="profile"   element={<S><ProfilePage /></S>} />
               <Route path="settings"  element={<S><SettingsPage /></S>} />