feat(workspaces): scaffold feature

Scaffold the workspaces feature package via pnpm turbo gen feature
(single Workspace entity, getWorkspace use case) and hand-wire the
aggregators: bindAll dispatcher (web-next), core-api app router, and
workspace deps. Release-please registration reverted per the root-only
versioning policy (AGENTS.md, ADR-027 retrofit). Pinned @trpc/server
to the repo-wide 11.16.0 resolution so instanceof TRPCError checks
share one module instance.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

apps/web-next/package.json

@@ -19,6 +19,7 @@
     "@repo/core-cms": "workspace:*",
     "@repo/core-shared": "workspace:*",
     "@repo/core-trpc": "workspace:^",
+    "@repo/workspaces": "workspace:*",
     "@sentry/nextjs": "^10.51.0",
     "@tailwindcss/postcss": "^4.3.0",
     "@tanstack/react-query": "^5.96.2",

apps/web-next/src/server/bind-production.smoke.test.ts

@@ -1,6 +1,6 @@
 // Dev-seed boot smoke (platform-retrofit story 04): prove `bindAll()` boots
-// the app with exactly the auth feature bound — no dangling DI symbols from
-// the deleted demo features.
+// the app with exactly the expected features bound — no dangling DI symbols
+// from the deleted demo features.
 //
 // Unlike bind-production.test.ts (which mocks the per-feature binders to test
 // dispatcher routing), this file runs the REAL auth dev-seed binder, so the
@@ -19,7 +19,7 @@ vi.mock("payload", () => ({
   getPayload: vi.fn(async () => ({ jobs: { queue: vi.fn() } })),
 }));
 
-describe("dev-seed boot smoke — bindAll() binds exactly the auth feature", () => {
+describe("dev-seed boot smoke — bindAll() binds exactly the expected features", () => {
   beforeEach(() => {
     vi.resetModules();
     vi.unstubAllEnvs();
@@ -82,7 +82,7 @@ describe("dev-seed boot smoke — bindAll() binds exactly the auth feature", ()
     expect(cookie.value).not.toBe("");
   });
 
-  it("wires auth and nothing else — the dispatcher imports exactly one feature's binders", () => {
+  it("wires auth + workspaces and nothing else — the dispatcher imports exactly the expected features' binders", () => {
     // vitest runs with cwd at the package root (jsdom rewrites
     // import.meta.url to an http: URL, so resolve from cwd instead).
     const source = readFileSync(
@@ -94,6 +94,6 @@ describe("dev-seed boot smoke — bindAll() binds exactly the auth feature", ()
     );
 
     expect(features.length).toBeGreaterThan(0);
-    expect([...new Set(features)].sort()).toEqual(["auth"]);
+    expect([...new Set(features)].sort()).toEqual(["auth", "workspaces"]);
   });
 });

apps/web-next/src/server/bind-production.ts

@@ -19,6 +19,8 @@ import {
 import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { bindProductionAuth } from "@repo/auth/di/bind-production";
 import { bindDevSeedAuth } from "@repo/auth/di/bind-dev-seed";
+import { bindProductionWorkspaces } from "@repo/workspaces/di/bind-production";
+import { bindDevSeedWorkspaces } from "@repo/workspaces/di/bind-dev-seed";
 
 let bindPromise: Promise<void> | null = null;
 
@@ -92,6 +94,7 @@ export async function bindAllProduction(): Promise<void> {
   };
 
   bindProductionAuth(ctx);
+  bindProductionWorkspaces(ctx);
 }
 
 /**
@@ -111,6 +114,7 @@ export async function bindAllDevSeed(): Promise<void> {
   };
 
   await bindDevSeedAuth(ctx);
+  await bindDevSeedWorkspaces(ctx);
 }
 
 /**