feat: workspace switcher, per-project filters and run stamping (stage 1)

Multi-project stage 1 against the shared hub (platform design
docs/architecture/projects.md, § Studio):

- ChainWorkspaceSwitcher in the Audit + Approvals AppBars: lists the
  registry (colour dot per project, shield for protected, honesty
  tooltip), 'All projects' stays reachable — a filter, not a jail.
  Selection is persisted and shared via the Workspace notifier.
- Audit page: list query AND live stream re-scoped hub-side on switch.
- Approvals page: pending + history scoped; the sidebar badge counts
  the active workspace's pending approvals.
- Flow runs are stamped with the active workspace; a flow file
  carrying its own project: keeps it (file wins, CLI semantics).
- Data layer: listProjects/ProjectRef; project fields on AuditEvent,
  PendingApproval(+Record), SavedFlow; project params through
  HubService. l10n DE+EN. Widget tests for the switcher contract.

Visual verification (light+dark screenshots) still pending — the
shared desktop was in active use; code paths are covered by
flutter test (26 green).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/flow_run_driver.dart

@@ -16,6 +16,7 @@ import 'dart:typed_data';
 import 'package:chain_studio_flow_editor/chain_studio_flow_editor.dart' as editor;
 
 import 'hub.dart';
+import 'workspace.dart';
 
 class StudioFlowRunDriver implements editor.FlowRunDriver {
   StudioFlowRunDriver();
@@ -27,11 +28,31 @@ class StudioFlowRunDriver implements editor.FlowRunDriver {
     required Map<String, Uint8List> fileInputs,
     required Map<String, String> fileMimes,
   }) async {
+    // Stamp the run with the active workspace — but the file wins:
+    // a flow carrying its own `project:` keeps it (same semantics
+    // as the CLI), so the override is only sent when the flow file
+    // has none. Resolution order hub-side is request > file > general.
+    var project = Workspace.instance.activeSlug;
+    if (project.isNotEmpty) {
+      try {
+        final flows = await HubService.instance.listFlows();
+        for (final f in flows) {
+          if (f.name == flowName && f.project.isNotEmpty) {
+            project = '';
+            break;
+          }
+        }
+      } catch (_) {
+        // Lookup failed — keep the workspace label. An unreachable
+        // hub fails the run itself a moment later anyway.
+      }
+    }
     final outputs = await HubService.instance.runSavedFlow(
       name: flowName,
       textInputs: textInputs,
       fileInputs: fileInputs,
       fileMimeTypes: fileMimes,
+      project: project,
     );
     final mapped = <String, editor.FlowOutputValue>{};
     for (final entry in outputs.entries) {