refactor(workspace): pass workspace object instead of id to service methods

- Replace workspace_id parameter with Workspace object reference in all workspace service methods
- Remove redundant find_workspace_by_id calls that were duplicated in each method
- Update all method signatures across approval, audit, billing, branding, core, settings and stats modules
- Modify SQL queries to bind ws.id instead of separate workspace_id parameter
- Add Workspace import to all affected modules
- Adjust method calls in API handlers to pass workspace object instead of id
- Consolidate workspace retrieval logic to single location per operation flow

api/auth/disable_2fa.rs

@@ -9,7 +9,7 @@ use crate::session::Session;
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/disable",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authDisableTwoFactor",
     summary = "Disable two-factor authentication",
     description = "Disable TOTP two-factor authentication for the current signed-in user. This requires verifying both the current password and a valid TOTP code or backup code. password must be encrypted with the current session RSA public key; a successfully verified backup code is consumed.",