feat: add list-my-workspaces operation and document IAM in API specs (#961)

Add a new `list-my-workspaces` operation so non-admin users can
discover which workspaces they have access to.  For OSS IAM, regular
users see their home workspace; admins see all workspaces.

Also add the full IAM service to both OpenAPI and AsyncAPI specs —
it was previously undocumented despite being a first-class service
on both HTTP and WebSocket interfaces.

specs/websocket/components/messages/ServiceRequest.yaml

@@ -9,6 +9,9 @@ description: |
 payload:
   description: Service request envelope with id, service, optional flow, and service-specific request payload
   oneOf:
+    # Global services
+    - $ref: './requests/IamRequest.yaml'
+
     # Workspace-scoped services (no flow parameter)
     - $ref: './requests/ConfigRequest.yaml'
     - $ref: './requests/FlowRequest.yaml'

specs/websocket/components/messages/requests/IamRequest.yaml

@@ -0,0 +1,25 @@
+type: object
+description: WebSocket request for IAM service (global service)
+required:
+  - id
+  - service
+  - request
+properties:
+  id:
+    type: string
+    description: Unique request identifier
+  service:
+    type: string
+    const: iam
+    description: Service identifier for IAM service
+  request:
+    $ref: '../../../../api/components/schemas/iam/IamRequest.yaml'
+examples:
+  - id: req-1
+    service: iam
+    request:
+      operation: whoami
+  - id: req-2
+    service: iam
+    request:
+      operation: list-my-workspaces