workspace-isolation-audit

Use when asked to audit or fix Supabase queries to ensure every query filters by workspace_id and wo