feat: workspace switcher, per-project filters and run stamping (stage 1)

Multi-project stage 1 against the shared hub (platform design
docs/architecture/projects.md, § Studio):

- ChainWorkspaceSwitcher in the Audit + Approvals AppBars: lists the
  registry (colour dot per project, shield for protected, honesty
  tooltip), 'All projects' stays reachable — a filter, not a jail.
  Selection is persisted and shared via the Workspace notifier.
- Audit page: list query AND live stream re-scoped hub-side on switch.
- Approvals page: pending + history scoped; the sidebar badge counts
  the active workspace's pending approvals.
- Flow runs are stamped with the active workspace; a flow file
  carrying its own project: keeps it (file wins, CLI semantics).
- Data layer: listProjects/ProjectRef; project fields on AuditEvent,
  PendingApproval(+Record), SavedFlow; project params through
  HubService. l10n DE+EN. Widget tests for the switcher contract.

Visual verification (light+dark screenshots) still pending — the
shared desktop was in active use; code paths are covered by
flutter test (26 green).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_de.arb

@@ -1664,5 +1664,8 @@
   "federationTokenLabel": "Bootstrap-Token (einmalig)",
   "federationConfigLabel": "Satelliten-Konfiguration (in den Satelliten einfügen)",
   "federationCopied": "In die Zwischenablage kopiert",
-  "federationEnrollmentHint": "Übergib das Token dem Satelliten-Betreiber über einen sicheren Kanal. Die mitgelieferte CA authentifiziert den ersten Connect des Satelliten."
+  "federationEnrollmentHint": "Übergib das Token dem Satelliten-Betreiber über einen sicheren Kanal. Die mitgelieferte CA authentifiziert den ersten Connect des Satelliten.",
+  "workspaceAll": "Alle Projekte",
+  "workspaceSwitcherTooltip": "Arbeitsbereich — filtert diese Ansicht und stempelt neue Läufe mit dem gewählten Projekt",
+  "workspaceProtectedHint": "Geschützt: logisch getrennt im gemeinsamen Hub — keine harte Prozessgrenze. Kritische Mandate nutzen einen abgeschotteten Bereich."
 }

lib/l10n/app_en.arb

@@ -1703,5 +1703,8 @@
   "federationTokenLabel": "Bootstrap token (single use)",
   "federationConfigLabel": "Satellite config (paste into the satellite)",
   "federationCopied": "Copied to clipboard",
-  "federationEnrollmentHint": "Hand the token to the satellite operator over a secure channel. The bundled CA authenticates the satellite's first connect."
+  "federationEnrollmentHint": "Hand the token to the satellite operator over a secure channel. The bundled CA authenticates the satellite's first connect.",
+  "workspaceAll": "All projects",
+  "workspaceSwitcherTooltip": "Workspace — filters this view and stamps new runs with the selected project",
+  "workspaceProtectedHint": "Protected: logically separated in the shared hub — no hard process barrier. Critical engagements use a sealed area."
 }

lib/l10n/app_localizations.dart

@@ -4890,6 +4890,24 @@ abstract class AppLocalizations {
   /// In en, this message translates to:
   /// **'Hand the token to the satellite operator over a secure channel. The bundled CA authenticates the satellite\'s first connect.'**
   String get federationEnrollmentHint;
+
+  /// No description provided for @workspaceAll.
+  ///
+  /// In en, this message translates to:
+  /// **'All projects'**
+  String get workspaceAll;
+
+  /// No description provided for @workspaceSwitcherTooltip.
+  ///
+  /// In en, this message translates to:
+  /// **'Workspace — filters this view and stamps new runs with the selected project'**
+  String get workspaceSwitcherTooltip;
+
+  /// No description provided for @workspaceProtectedHint.
+  ///
+  /// In en, this message translates to:
+  /// **'Protected: logically separated in the shared hub — no hard process barrier. Critical engagements use a sealed area.'**
+  String get workspaceProtectedHint;
 }
 
 class _AppLocalizationsDelegate

lib/l10n/app_localizations_de.dart

@@ -2871,4 +2871,15 @@ class AppLocalizationsDe extends AppLocalizations {
   @override
   String get federationEnrollmentHint =>
       'Übergib das Token dem Satelliten-Betreiber über einen sicheren Kanal. Die mitgelieferte CA authentifiziert den ersten Connect des Satelliten.';
+
+  @override
+  String get workspaceAll => 'Alle Projekte';
+
+  @override
+  String get workspaceSwitcherTooltip =>
+      'Arbeitsbereich — filtert diese Ansicht und stempelt neue Läufe mit dem gewählten Projekt';
+
+  @override
+  String get workspaceProtectedHint =>
+      'Geschützt: logisch getrennt im gemeinsamen Hub — keine harte Prozessgrenze. Kritische Mandate nutzen einen abgeschotteten Bereich.';
 }

lib/l10n/app_localizations_en.dart

@@ -2874,4 +2874,15 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get federationEnrollmentHint =>
       'Hand the token to the satellite operator over a secure channel. The bundled CA authenticates the satellite\'s first connect.';
+
+  @override
+  String get workspaceAll => 'All projects';
+
+  @override
+  String get workspaceSwitcherTooltip =>
+      'Workspace — filters this view and stamps new runs with the selected project';
+
+  @override
+  String get workspaceProtectedHint =>
+      'Protected: logically separated in the shared hub — no hard process barrier. Critical engagements use a sealed area.';
 }