fix: initialize workspace before its first model selection

[rudycelekli]

Summary

Initialize the workspace before saving its first selected model.

The workspace manager can read its default model before chat or vault has created a database workspace. Its public settings.selectModel mutation then inserts a setting referencing that absent workspace and fails the workspace foreign key. Call the existing idempotent ensureScope service before that write, creating the workspace and membership through the same supported initialization used by other services.

Reproduction and controls

The regression runs the actual tRPC application caller and settings service with real PGlite, Drizzle and committed migrations. Only the database driver getter is replaced. Reading a fresh workspace returns the supported default model without creating a row; selecting that default through the public mutation then fails on unchanged source. The initialized-workspace control succeeds.

Before: 1 failure / 1 passing control. After: 4/4 tests pass including the two existing router controls. Tests also check persistence, membership initialization and later model changes without duplicate rows. No HTTP authentication, provider availability, live model execution or deployed PostgreSQL claim.

Required local gates with Node 24.18.0 and declared pnpm 11.24.0:

• pnpm check: 6/6 tasks pass, including lint and generated-route types. The test task covers 96 files / 878 tests. The final run reused three successful task results from the preceding exact-source check; lint/types ran successfully after the actual next typegen command. The earlier serial check failed on generated Next route globals before type generation; that failure is retained with the successful rerun.
• pnpm build: passes using owned public database/Kernel/auth URL placeholders. No deployment or live service claim.
• Local runtime remains blocked by host Docker cleanup: earlier unchanged fixtures exited 1 at the shipped cleanup timeout, and this branch did not repeat that blocked local run.

The unchanged declared Checks workflow completed successfully on exact signed head 2c5a9818f2f2e29086ba9e5d724684dc4480871e: frozen dependency installation, full pnpm check (96 files / 878 tests, all six check tasks), and complete pnpm test:runtime (two isolated mock-model workflow evals / 13 gates, including cleanup). Hosted Node 24.21.0 follows the declared Node 24 version; pnpm is 11.24.0. The PR merge checkout tree matches the reviewed source head. No workflow, dependency or runtime fixture changes were made.

Scope and overlap

Two source insertions plus colocated caller regression tests. No schema, migration, dependency, authentication, UI or workflow changes. Pending PR #146 changes the same settings file to add an optional direct Gemini provider and rename model helpers. Its current patch still does not initialize the workspace before the write; its provider feature does not fix this independently reproduced first-use failure. The other 13 current open PRs have no direct path overlap. Existing current issues and recent closed/merged PR records were screened for this cause.

AI assistance was used for investigation, implementation, tests and review under the submitting account. Signed DCO commit included.