feat: workspace-based multi-tenancy, replacing user as tenancy axis (#840)

Introduces `workspace` as the isolation boundary for config, flows,
library, and knowledge data. Removes `user` as a schema-level field
throughout the code, API specs, and tests; workspace provides the
same separation more cleanly at the trusted flow.workspace layer
rather than through client-supplied message fields.

Design
------
- IAM tech spec (docs/tech-specs/iam.md) documents current state,
  proposed auth/access model, and migration direction.
- Data ownership model (docs/tech-specs/data-ownership-model.md)
  captures the workspace/collection/flow hierarchy.

Schema + messaging
------------------
- Drop `user` field from AgentRequest/Step, GraphRagQuery,
  DocumentRagQuery, Triples/Graph/Document/Row EmbeddingsRequest,
  Sparql/Rows/Structured QueryRequest, ToolServiceRequest.
- Keep collection/workspace routing via flow.workspace at the
  service layer.
- Translators updated to not serialise/deserialise user.

API specs
---------
- OpenAPI schemas and path examples cleaned of user fields.
- Websocket async-api messages updated.
- Removed the unused parameters/User.yaml.

Services + base
---------------
- Librarian, collection manager, knowledge, config: all operations
  scoped by workspace. Config client API takes workspace as first
  positional arg.
- `flow.workspace` set at flow start time by the infrastructure;
  no longer pass-through from clients.
- Tool service drops user-personalisation passthrough.

CLI + SDK
---------
- tg-init-workspace and workspace-aware import/export.
- All tg-* commands drop user args; accept --workspace.
- Python API/SDK (flow, socket_client, async_*, explainability,
  library) drop user kwargs from every method signature.

MCP server
----------
- All tool endpoints drop user parameters; socket_manager no longer
  keyed per user.

Flow service
------------
- Closure-based topic cleanup on flow stop: only delete topics
  whose blueprint template was parameterised AND no remaining
  live flow (across all workspaces) still resolves to that topic.
  Three scopes fall out naturally from template analysis:
    * {id} -> per-flow, deleted on stop
    * {blueprint} -> per-blueprint, kept while any flow of the
      same blueprint exists
    * {workspace} -> per-workspace, kept while any flow in the
      workspace exists
    * literal -> global, never deleted (e.g. tg.request.librarian)
  Fixes a bug where stopping a flow silently destroyed the global
  librarian exchange, wedging all library operations until manual
  restart.

RabbitMQ backend
----------------
- heartbeat=60, blocked_connection_timeout=300. Catches silently
  dead connections (broker restart, orphaned channels, network
  partitions) within ~2 heartbeat windows, so the consumer
  reconnects and re-binds its queue rather than sitting forever
  on a zombie connection.

Tests
-----
- Full test refresh: unit, integration, contract, provenance.
- Dropped user-field assertions and constructor kwargs across
  ~100 test files.
- Renamed user-collection isolation tests to workspace-collection.

tests/unit/test_embeddings/test_document_embeddings_processor.py

@@ -20,9 +20,8 @@ def processor():
     )
 
 
-def _make_chunk_message(chunk_text="Hello world", doc_id="doc-1",
-                        user="test", collection="default"):
-    metadata = Metadata(id=doc_id, user=user, collection=collection)
+def _make_chunk_message(chunk_text="Hello world", doc_id="doc-1", collection="default"):
+    metadata = Metadata(id=doc_id, collection=collection)
     value = Chunk(metadata=metadata, chunk=chunk_text, document_id=doc_id)
     msg = MagicMock()
     msg.value.return_value = value
@@ -127,7 +126,7 @@ class TestDocumentEmbeddingsProcessor:
     @pytest.mark.asyncio
     async def test_metadata_preserved(self, processor):
         """Output should carry the original metadata."""
-        msg = _make_chunk_message(user="alice", collection="reports", doc_id="d1")
+        msg = _make_chunk_message(collection="reports", doc_id="d1")
 
         mock_request = AsyncMock(return_value=EmbeddingsResponse(
             error=None, vectors=[[0.0]]
@@ -144,7 +143,6 @@ class TestDocumentEmbeddingsProcessor:
         await processor.on_message(msg, MagicMock(), flow)
 
         result = mock_output.send.call_args[0][0]
-        assert result.metadata.user == "alice"
         assert result.metadata.collection == "reports"
         assert result.metadata.id == "d1"
 

tests/unit/test_embeddings/test_graph_embeddings_processor.py

@@ -27,8 +27,8 @@ def _make_entity_context(name, context, chunk_id="chunk-1"):
     return MagicMock(entity=entity, context=context, chunk_id=chunk_id)
 
 
-def _make_message(entities, doc_id="doc-1", user="test", collection="default"):
-    metadata = Metadata(id=doc_id, user=user, collection=collection)
+def _make_message(entities, doc_id="doc-1", collection="default"):
+    metadata = Metadata(id=doc_id, collection=collection)
     value = EntityContexts(metadata=metadata, entities=entities)
     msg = MagicMock()
     msg.value.return_value = value
@@ -151,7 +151,7 @@ class TestGraphEmbeddingsBatchProcessing:
             _make_entity_context(f"E{i}", f"ctx {i}")
             for i in range(5)
         ]
-        msg = _make_message(entities, doc_id="doc-42", user="alice", collection="main")
+        msg = _make_message(entities, doc_id="doc-42", collection="main")
 
         mock_embed = AsyncMock(return_value=[[0.0]] * 5)
         mock_output = AsyncMock()
@@ -168,7 +168,6 @@ class TestGraphEmbeddingsBatchProcessing:
         for call in mock_output.send.call_args_list:
             result = call[0][0]
             assert result.metadata.id == "doc-42"
-            assert result.metadata.user == "alice"
             assert result.metadata.collection == "main"
 
     @pytest.mark.asyncio

tests/unit/test_embeddings/test_row_embeddings_processor.py

@@ -214,11 +214,11 @@ class TestRowEmbeddingsProcessor(IsolatedAsyncioTestCase):
             }
         }
 
-        await processor.on_schema_config(config_data, 1)
+        await processor.on_schema_config("default", config_data, 1)
 
-        assert 'customers' in processor.schemas
-        assert processor.schemas['customers'].name == 'customers'
-        assert len(processor.schemas['customers'].fields) == 3
+        assert 'customers' in processor.schemas["default"]
+        assert processor.schemas["default"]['customers'].name == 'customers'
+        assert len(processor.schemas["default"]['customers'].fields) == 3
 
     async def test_on_schema_config_handles_missing_type(self):
         """Test that missing schema type is handled gracefully"""
@@ -236,9 +236,9 @@ class TestRowEmbeddingsProcessor(IsolatedAsyncioTestCase):
             'other_type': {}
         }
 
-        await processor.on_schema_config(config_data, 1)
+        await processor.on_schema_config("default", config_data, 1)
 
-        assert processor.schemas == {}
+        assert processor.schemas.get("default", {}) == {}
 
     async def test_on_message_drops_unknown_collection(self):
         """Test that messages for unknown collections are dropped"""
@@ -285,7 +285,7 @@ class TestRowEmbeddingsProcessor(IsolatedAsyncioTestCase):
         }
 
         processor = Processor(**config)
-        processor.known_collections[('test_user', 'test_collection')] = {}
+        processor.known_collections[('default', 'test_collection')] = {}
         # No schemas registered
 
         metadata = MagicMock()
@@ -322,17 +322,19 @@ class TestRowEmbeddingsProcessor(IsolatedAsyncioTestCase):
         }
 
         processor = Processor(**config)
-        processor.known_collections[('test_user', 'test_collection')] = {}
+        processor.known_collections[('default', 'test_collection')] = {}
 
         # Set up schema
-        processor.schemas['customers'] = RowSchema(
-            name='customers',
-            description='Customer records',
-            fields=[
-                Field(name='id', type='text', primary=True),
-                Field(name='name', type='text', indexed=True),
-            ]
-        )
+        processor.schemas["default"] = {
+            'customers': RowSchema(
+                name='customers',
+                description='Customer records',
+                fields=[
+                    Field(name='id', type='text', primary=True),
+                    Field(name='name', type='text', indexed=True),
+                ]
+            )
+        }
 
         metadata = MagicMock()
         metadata.user = 'test_user'
@@ -372,6 +374,7 @@ class TestRowEmbeddingsProcessor(IsolatedAsyncioTestCase):
             return MagicMock()
 
         mock_flow = MagicMock(side_effect=flow_factory)
+        mock_flow.workspace = "default"
 
         await processor.on_message(mock_msg, MagicMock(), mock_flow)