feat(workspace): allow creation without an initial repository

Keep bootstrap, signing identity, config and resource-key allocation atomic with optional Repository intent. Preserve repository-present fingerprints for saved receipts; replay reads current authority at the initial key and never recreates missing assets.

Provide explicit repository-free CLI creation, optional TUI/Web creation inputs, nullable generated contracts, and valid empty catalog/Worker paths. Retain existing authenticated non-owner viewing policy pending the T-717 authorization decision.

Validation: root cargo check; server tests 639 lib + 11 bin; server-api 70 default / 77 typescript; client 52 lib + 2 integration; tui 337; yoi 11 lib + 120 bin. OpenAPI/TS freshness, cargo fmt and diff checks pass. Web check/build, 18 model tests, 268 component tests and Chromium 8 width/theme combinations pass; before/after visual evidence is documented in web/workspace/test/visual-review. Full Web suite has one independently reproduced baseline Ticket source-policy failure.

crates/client/tests/backend_workspace.rs

@@ -8,11 +8,11 @@ fn workspace_creation_request_preserves_operation_key_for_retry() {
     let request = CreateBackendWorkspaceRequest {
         operation_key: "workspace-create-1".to_string(),
         display_name: "Alpha".to_string(),
-        repository: CreateBackendWorkspaceRepository {
+        repository: Some(CreateBackendWorkspaceRepository {
             repository_key: "main".to_string(),
             uri: "/srv/repos/alpha".to_string(),
             default_ref: Some("develop".to_string()),
-        },
+        }),
     };
 
     assert_eq!(request.clone(), request);