chore: add workspaceId to ApiKeyEnvironment and simplify auth

Phase 6 of environment deprecation:
- Add nullable workspaceId FK to ApiKeyEnvironment schema
- SQL migration with inline backfill from Environment table
- Dual-write workspaceId when creating API key environment permissions
- Auth reads workspaceId directly from ApiKeyEnvironment (falls back to Environment join)
- Add hasWorkspacePermission utility for workspace-scoped permission checks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/database/migration/20260401000002_add_workspace_id_to_api_key_environment/migration.sql

@@ -0,0 +1,15 @@
+-- AlterTable
+ALTER TABLE "ApiKeyEnvironment" ADD COLUMN "workspaceId" TEXT;
+
+-- AddForeignKey
+ALTER TABLE "ApiKeyEnvironment" ADD CONSTRAINT "ApiKeyEnvironment_workspaceId_fkey" FOREIGN KEY ("workspaceId") REFERENCES "Workspace"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- CreateIndex
+CREATE INDEX "ApiKeyEnvironment_workspaceId_idx" ON "ApiKeyEnvironment"("workspaceId");
+
+-- Backfill workspaceId from Environment table
+UPDATE "ApiKeyEnvironment" ake
+SET "workspaceId" = e."workspaceId"
+FROM "Environment" e
+WHERE ake."environmentId" = e."id"
+  AND ake."workspaceId" IS NULL;

packages/database/schema.prisma

@@ -669,6 +669,7 @@ model Workspace {
   workspaceTeams                    WorkspaceTeam[]
   customHeadScripts                 String? // Custom HTML scripts for link surveys (self-hosted only)
   feedbackRecordDirectoryWorkspaces FeedbackRecordDirectoryWorkspace[]
+  apiKeyEnvironments                ApiKeyEnvironment[]
 
   // Direct resource relations (for environment deprecation migration)
   surveys              Survey[]
@@ -679,7 +680,6 @@ model Workspace {
   tags                 Tag[]
   segments             Segment[]
   integrations         Integration[]
-  apiKeyEnvironments   ApiKeyEnvironment[]
 
   @@unique([organizationId, name])
 }