feat: add list-my-workspaces operation and document IAM in API specs (#961)

Add a new `list-my-workspaces` operation so non-admin users can
discover which workspaces they have access to.  For OSS IAM, regular
users see their home workspace; admins see all workspaces.

Also add the full IAM service to both OpenAPI and AsyncAPI specs —
it was previously undocumented despite being a first-class service
on both HTTP and WebSocket interfaces.

specs/api/openapi.yaml

@@ -89,6 +89,8 @@ security:
   - bearerAuth: []
 
 tags:
+  - name: IAM
+    description: Identity and access management (global)
   - name: Config
     description: Configuration management (workspace-scoped)
   - name: Flow
@@ -109,6 +111,11 @@ tags:
     description: System metrics and monitoring
 
 paths:
+  # Global services
+  /api/v1/iam:
+    $ref: './paths/iam.yaml'
+
+  # Workspace-scoped services
   /api/v1/config:
     $ref: './paths/config.yaml'
   /api/v1/flow: