fix(inbox): read workspace ID from request context

After the slug-first URL refactor, the frontend sends X-Workspace-Slug
and the workspace middleware resolves it into a UUID stored in the
request context. The inbox handlers still read X-Workspace-ID directly
from the request header, which is now absent, so every inbox query ran
with an empty workspace_id and returned zero rows.

Switch all six inbox handlers to ctxWorkspaceID(r.Context()), matching
the pattern already used by chat / issue / project / autopilot. No
frontend changes required — the slug header path was already correct.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/internal/handler/inbox.go

@@ -90,7 +90,7 @@ func (h *Handler) ListInbox(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	workspaceID := r.Header.Get("X-Workspace-ID")
+	workspaceID := ctxWorkspaceID(r.Context())
 
 	items, err := h.Queries.ListInboxItems(r.Context(), db.ListInboxItemsParams{
 		WorkspaceID:   parseUUID(workspaceID),
@@ -170,7 +170,7 @@ func (h *Handler) CountUnreadInbox(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	workspaceID := r.Header.Get("X-Workspace-ID")
+	workspaceID := ctxWorkspaceID(r.Context())
 
 	count, err := h.Queries.CountUnreadInbox(r.Context(), db.CountUnreadInboxParams{
 		WorkspaceID:   parseUUID(workspaceID),
@@ -190,7 +190,7 @@ func (h *Handler) MarkAllInboxRead(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	workspaceID := r.Header.Get("X-Workspace-ID")
+	workspaceID := ctxWorkspaceID(r.Context())
 
 	count, err := h.Queries.MarkAllInboxRead(r.Context(), db.MarkAllInboxReadParams{
 		WorkspaceID: parseUUID(workspaceID),
@@ -215,7 +215,7 @@ func (h *Handler) ArchiveAllInbox(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	workspaceID := r.Header.Get("X-Workspace-ID")
+	workspaceID := ctxWorkspaceID(r.Context())
 
 	count, err := h.Queries.ArchiveAllInbox(r.Context(), db.ArchiveAllInboxParams{
 		WorkspaceID: parseUUID(workspaceID),
@@ -240,7 +240,7 @@ func (h *Handler) ArchiveAllReadInbox(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	workspaceID := r.Header.Get("X-Workspace-ID")
+	workspaceID := ctxWorkspaceID(r.Context())
 
 	count, err := h.Queries.ArchiveAllReadInbox(r.Context(), db.ArchiveAllReadInboxParams{
 		WorkspaceID: parseUUID(workspaceID),
@@ -265,7 +265,7 @@ func (h *Handler) ArchiveCompletedInbox(w http.ResponseWriter, r *http.Request)
 	if !ok {
 		return
 	}
-	workspaceID := r.Header.Get("X-Workspace-ID")
+	workspaceID := ctxWorkspaceID(r.Context())
 
 	count, err := h.Queries.ArchiveCompletedInbox(r.Context(), db.ArchiveCompletedInboxParams{
 		WorkspaceID: parseUUID(workspaceID),