Add integration suites: workspace authz, share-link lifecycle, uploads

Commit notes

The three highest-risk untested route surfaces from the June audit now have DB/Redis-backed coverage using a shared route harness that mirrors the global error mapping:

- workspaces: full owner/member/non-member authz matrix across list, update, delete, and member removal (incl. memberCount semantics). - share-links: create -> public info/access lifecycle, creation IDOR guard, password protection, expiry, owner-only deletion, the activity-IDOR regression from e1a6141, and free-plan limits (3 links/month, password = Pro). - uploads: direct-upload initiation (Redis session + locally-signed presigned URL + user-scoped storage key), non-audio rejection, quota 403, session list/delete cleanup, and the legacy chunked redirect parity. The storage-dependent complete path is documented as needing MinIO.

All suites skip cleanly without infra and run for real in CI.

[private session redacted]