feat(webui): add project workspaces and access controls (#4007)

* feat(webui): add project workspaces and access controls

* feat(webui): add project workspaces and access controls

* refactor(tools): centralize workspace access resolution

* refactor(webui): remove unused workspace host state

* fix(webui): hide estimated file edit label

* fix(webui): clarify file edit deletion feedback

* fix(webui): label deleted file activity

* fix(webui): flatten file edit activity rows

* fix(core): remove path-only patch deletion

* fix(core): keep apply patch non-destructive

* refactor(webui): trim workspace host plumbing

* fix(tools): register exec with tools config

webui/src/tests/bootstrap.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+
+import { deriveWsUrl } from "@/lib/bootstrap";
+
+describe("bootstrap helpers", () => {
+  it("prefers the server-provided websocket URL over the current dev host", () => {
+    expect(deriveWsUrl("/", "tok en", "ws://127.0.0.1:8765/")).toBe(
+      "ws://127.0.0.1:8765/?token=tok%20en",
+    );
+  });
+
+  it("preserves the host socket bridge URL", () => {
+    expect(deriveWsUrl("/", "tok en", "nanobot-host://engine/")).toBe(
+      "nanobot-host://engine/?token=tok%20en",
+    );
+  });
+
+  it("falls back to the current window host for legacy bootstrap payloads", () => {
+    expect(deriveWsUrl("/", "tok")).toBe(
+      "ws://localhost:3000/?token=tok",
+    );
+  });
+});