feat(workspaces): add Mode B workspace switcher

[man4ish]

Mode B Phase 2 — Workspace Switcher

Adds the top-bar workspace switcher: a user can move between their personal workspace and any team they belong to, entirely through the existing auth-service authority.

What this does

• Workspace switching through the existing auth-service authority. The new POST /auth/switch-team route in routes_auth_proxy.py is a pure relay (_proxy_to_auth), identical in shape to every other route in this file. Control-center never inspects or trusts team_id itself.
• Server-side team identity resolution. team_id is resolved on the auth-service side from the presented token's own sub claim, with org-membership and team-membership independently re-checked on every switch. Control-center only relays the request/response.
• Personal workspace support via team_id: null. Treated as a real, meaningful state end-to-end (not a sentinel), including in the new switchTeam(teamId: number | null) client function.
• Token persistence → session validation → reload, in that order. switchTeam() persists the reissued access token, then calls validateSession() on it, and only resolves successfully once that validation succeeds. TeamSwitcher.tsx calls window.location.reload() only after switchTeam() resolves.
• No client-supplied X-Team-Id / X-Workspace-Id mechanism. The only place client intent is expressed is the team_id field in the /auth/switch-team request body; there is a dedicated regression test asserting neither header is ever sent.
• Team/org membership isolation remains server-authoritative. TeamSwitcher.tsx reads orgId/userId/teamId only from the authenticated SessionUser and uses listTeams() purely for display filtering — the server's own membership re-check on /auth/switch-team is the only authority on whether a switch is allowed.
• Integration with the existing Teams UI/session model. SessionUser gains teamId/teamRole (nullable, mirrors the existing orgId/orgRoles shape). TeamSwitcher is wired into TopAppBar next to the existing (placeholder) OrgSelector.

Rebase note

This branch had zero commits unique from its fork point, so bringing it onto current main (PR #35, Team Management v0.8.0 Step 5) was a fast-forward, not a replay — the implementation diff is byte-for-byte identical before and after. The only adjustment needed was mechanical fixture updates required by interfaces the two branches both extended independently:

• TeamSwitcher.test.tsx's Team mocks gained description/created_by_user_id (added by PR feat(teams): Team Management v0.8.0 Step 5 — Control Center UI #35's Team interface).
• PR feat(teams): Team Management v0.8.0 Step 5 — Control Center UI #35's own TeamMembersPanel.test.tsx SessionUser mock gained teamId/teamRole (added by this branch).

No functional change to PR #35's Step 5 implementation.

Verification

• Backend: 957 passed, 0 failed
• Coverage: 99.80% (≥98% gate)
• Frontend/Vitest: 37 files, 464 passed, 0 failed
• TypeScript: 0 errors
• Security/isolation checks: passed

Backend tests were run with PYTHONPATH pointed at this worktree's own backend/src to avoid a known editable-install shadowing issue where control_center can resolve to a different checkout's src/ instead of the one under test.

🤖 Generated with Claude Code