refactor(workspace): pass workspace object instead of id to service methods

- Replace workspace_id parameter with Workspace object reference in all workspace service methods
- Remove redundant find_workspace_by_id calls that were duplicated in each method
- Update all method signatures across approval, audit, billing, branding, core, settings and stats modules
- Modify SQL queries to bind ws.id instead of separate workspace_id parameter
- Add Workspace import to all affected modules
- Adjust method calls in API handlers to pass workspace object instead of id
- Consolidate workspace retrieval logic to single location per operation flow

api/auth/verify_2fa.rs

@@ -9,7 +9,7 @@ use crate::session::Session;
 #[utoipa::path(
     post,
     path = "/api/v1/auth/2fa/verify",
-    tag = "Auth / 2FA",
+    tag = "Auth",
     operation_id = "authVerifyAndEnableTwoFactor",
     summary = "Verify and enable two-factor authentication",
     description = "After initializing with /auth/2fa/enable, submit the 6-digit TOTP code generated by the authenticator app. On success, the current user's 2FA status is set to enabled. A small clock drift of one 30-second window before or after is allowed.",