refactor(workspace): pass workspace object instead of id to service methods

- Replace workspace_id parameter with Workspace object reference in all workspace service methods
- Remove redundant find_workspace_by_id calls that were duplicated in each method
- Update all method signatures across approval, audit, billing, branding, core, settings and stats modules
- Modify SQL queries to bind ws.id instead of separate workspace_id parameter
- Add Workspace import to all affected modules
- Adjust method calls in API handlers to pass workspace object instead of id
- Consolidate workspace retrieval logic to single location per operation flow

api/workspace/upload_avatar.rs

@@ -0,0 +1,60 @@
+use actix_web::{HttpResponse, web};
+use serde::Deserialize;
+
+use crate::api::response::{ApiErrorResponse, ApiResponse};
+use crate::error::AppError;
+use crate::models::workspaces::Workspace;
+use crate::service::AppService;
+use crate::session::Session;
+
+#[derive(Deserialize, utoipa::IntoParams)]
+pub struct UploadAvatarQuery {
+    pub content_type: Option<String>,
+    pub file_name: Option<String>,
+}
+
+#[utoipa::path(
+    post,
+    path = "/api/v1/workspaces/{workspace_name}/avatar",
+    tag = "Workspaces",
+    operation_id = "workspaceUploadAvatar",
+    summary = "Upload workspace avatar",
+    description = "Upload an avatar image for a workspace. Requires admin role. Maximum size 5 MB. Supported: png, jpg, gif, webp.",
+    params(
+        ("workspace_name" = String, Path, description = "Workspace name."),
+        ("content_type" = Option<String>, Query, description = "MIME type of the uploaded image."),
+        ("file_name" = Option<String>, Query, description = "Original file name for extension detection.")
+    ),
+    request_body(
+        content = Vec<u8>,
+        description = "Raw image bytes.",
+        content_type = "application/octet-stream"
+    ),
+    responses(
+        (status = 200, description = "Avatar uploaded.", body = ApiResponse<Workspace>),
+        (status = 400, description = "Unsupported image format or file too large.", body = ApiErrorResponse),
+        (status = 401, description = "Unauthenticated or insufficient role.", body = ApiErrorResponse),
+        (status = 404, description = "Workspace not found.", body = ApiErrorResponse),
+        (status = 500, description = "Storage or database failure.", body = ApiErrorResponse)
+    )
+)]
+pub async fn handle(
+    service: web::Data<AppService>,
+    session: Session,
+    path: web::Path<String>,
+    query: web::Query<UploadAvatarQuery>,
+    body: web::Bytes,
+) -> Result<HttpResponse, AppError> {
+    let ws = service.workspace.find_workspace_by_name(&path).await?;
+    let data = service
+        .workspace
+        .workspace_upload_avatar(
+            &session,
+            &ws,
+            body.to_vec(),
+            query.content_type.clone(),
+            query.file_name.clone(),
+        )
+        .await?;
+    Ok(HttpResponse::Ok().json(ApiResponse::new(data)))
+}