epic: @TenantId Hibernate native multi-tenancy + workspace_id denormalization

[FelixTJDietrich]

Context: #1290 (epic #1097 server foundations) delivered SQL-layer multi-tenancy via a regex-based WorkspaceStatementInspector running over every emitted statement. This is a runtime guardrail, not a structural fix.

The structural fix is Hibernate's native multi-tenancy via @TenantId on every workspace-scoped entity, with workspace_id denormalized onto each table so the predicate doesn't need a join to reach.

ADR 0004 documents why this was cut from the foundations epic: 20+ entities need workspace_id denormalized (some across multi-hop FK chains), each one a non-trivial migration with backfill semantics. 6–12 week effort.

Why eventually

The current inspector approach has documented holes:

• 4 regex carve-outs (INSERT, PK-only DML, PK-anchored SELECT, workspace_id word-boundary) admit edge cases that depend on the surrogate-key invariant holding.
• ~71 repositories are marked @WorkspaceAgnostic for FK-chain scoping. Each one is a defect surface — drop the annotation and queries pass the inspector with the wrong scope.
• Inspector runs in log mode in prod today; the flip to throw is a separate decision (#TBD — file when ready).

Native @TenantId is a single declarative invariant per entity, enforced at the Hibernate level rather than at SQL-shape level.

What's in scope when this lands

1. Add workspace_id NOT NULL column to every workspace-scoped table that doesn't already have one. Backfill from the existing FK chain.
2. Annotate every workspace-scoped @Entity with @TenantId.
3. Register a CurrentTenantIdentifierResolver that reads from the existing WorkspaceContext.
4. Remove WorkspaceStatementInspector and @WorkspaceAgnostic (or repurpose @WorkspaceAgnostic to mean "intentionally cross-tenant query" with a registered tenant override).
5. Migrate all repositories that today scope via FK chain or via @Where/@Filter to plain repositories — @TenantId makes the predicate implicit.

Why not now

• The Boot 4 / Hibernate 7 baseline (feat(server): upgrade to Spring Boot 4 / Hibernate 7 / Modulith 2 / Security 7 baseline #1193) only just landed.
• Several large in-flight workspace features (epic: workspace integration registry, credentials, and lifecycle #1197 integration registry, epic: multi-actor multi-scope practice findings #1199 multi-actor findings, feat(server): workspace_integration schema + IntegrationCredentialProvider SPI #1215 workspace_integration schema) will land more entities before we want to migrate; doing this before they settle wastes effort.
• Squash-to-baseline (refactor(db): squash pre-v0.63.1 Liquibase changelog history into a baseline #1283) should land first so the migrations live on a small history rather than 600+ changesets.

Acceptance (epic-level)

• Every workspace-scoped entity declares @TenantId with a workspace_id column
• CurrentTenantIdentifierResolver reads from WorkspaceContext
• WorkspaceStatementInspector removed (or demoted to assertion-only behind a debug flag)
• All @WorkspaceAgnostic annotations either deleted or converted to tenant overrides
• Backfill migrations validated against a prod-clone DB
• No regression in CrossWorkspaceIsolationTest (feat(server): CrossWorkspaceIsolationTest reflection-walks every @WorkspaceScopedController #1292)