refactor(workspace): pass workspace object instead of id to service methods

- Replace workspace_id parameter with Workspace object reference in all workspace service methods
- Remove redundant find_workspace_by_id calls that were duplicated in each method
- Update all method signatures across approval, audit, billing, branding, core, settings and stats modules
- Modify SQL queries to bind ws.id instead of separate workspace_id parameter
- Add Workspace import to all affected modules
- Adjust method calls in API handlers to pass workspace object instead of id
- Consolidate workspace retrieval logic to single location per operation flow

api/auth/regenerate_2fa_backup_codes.rs

@@ -21,7 +21,7 @@ pub struct Regenerate2FABackupCodesResponse {
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/backup-codes/regenerate",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authRegenerateTwoFactorBackupCodes",
     summary = "Regenerate 2FA backup codes",
     description = "After verifying the current password, generate a new set of backup codes for a user with 2FA enabled and replace the old backup codes. password must be encrypted with the current session RSA public key. Backup codes are returned in plaintext only once in this response; clients must prompt users to store them securely.",