refactor(workspace): pass workspace object instead of id to service methods

- Replace workspace_id parameter with Workspace object reference in all workspace service methods
- Remove redundant find_workspace_by_id calls that were duplicated in each method
- Update all method signatures across approval, audit, billing, branding, core, settings and stats modules
- Modify SQL queries to bind ws.id instead of separate workspace_id parameter
- Add Workspace import to all affected modules
- Adjust method calls in API handlers to pass workspace object instead of id
- Consolidate workspace retrieval logic to single location per operation flow

api/auth/disable_2fa.rs

@@ -9,7 +9,7 @@ use crate::session::Session;
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/disable",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authDisableTwoFactor",
     summary = "Disable two-factor authentication",
     description = "Disable TOTP two-factor authentication for the current signed-in user. This requires verifying both the current password and a valid TOTP code or backup code. password must be encrypted with the current session RSA public key; a successfully verified backup code is consumed.",

api/auth/enable_2fa.rs

@@ -9,7 +9,7 @@ use crate::session::Session;
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/enable",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authPrepareTwoFactorEnable",
     summary = "Initialize two-factor authentication setup",
     description = "Generate a new TOTP secret, otpauth QR-code URI, and 10 one-time backup codes for the current signed-in user, and save them in a not-yet-enabled state. Clients must guide the user to scan the QR code and call /auth/2fa/verify with a dynamic code before 2FA is actually enabled. Backup codes are returned in plaintext only once in this response; frontends must remind users to store them securely.",

api/auth/get_2fa_status.rs

@@ -9,7 +9,7 @@ use crate::session::Session;
 #[utoipa::path(
     get,
     path = "/api/v1/auth/2fa/status",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authGetTwoFactorStatus",
     summary = "Get two-factor authentication status",
     description = "Read the current signed-in user's TOTP two-factor authentication status, including whether it is enabled, the authentication method, and whether backup codes are still available.",

api/auth/regenerate_2fa_backup_codes.rs

@@ -21,7 +21,7 @@ pub struct Regenerate2FABackupCodesResponse {
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/backup-codes/regenerate",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authRegenerateTwoFactorBackupCodes",
     summary = "Regenerate 2FA backup codes",
     description = "After verifying the current password, generate a new set of backup codes for a user with 2FA enabled and replace the old backup codes. password must be encrypted with the current session RSA public key. Backup codes are returned in plaintext only once in this response; clients must prompt users to store them securely.",

api/auth/verify_2fa.rs

@@ -9,7 +9,7 @@ use crate::session::Session;
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/verify",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authVerifyAndEnableTwoFactor",
     summary = "Verify and enable two-factor authentication",
     description = "After initializing with /auth/2fa/enable, submit the 6-digit TOTP code generated by the authenticator app. On success, the current user's 2FA status is set to enabled. A small clock drift of one 30-second window before or after is allowed.",