feat(auth): login + change_password re-issue JWTs with wid + role

After PR4 every protected request demands wid. Three JWT-issue paths
must encode it; T4.8/T4.9 covered /initialize and /register, and this
commit closes the remaining two:

- login_local calls _ensure_default_workspace (idempotent — returns
  the existing default_workspace_id when set) so users who pre-date
  PR4 are backfilled at login time, and signs the new cookie with
  wid + role='owner'.
- change_password does the same, ensuring a password change does not
  strip the workspace claim and lock the user out on their next
  request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/gateway/routers/auth.py

@@ -340,7 +340,15 @@ async def login_local(
         )
 
     _record_login_success(client_ip)
-    token = create_access_token(str(user.id), token_version=user.token_version)
+    # Ensure the user has a workspace (covers pre-PR4 users still in DB
+    # whose default_workspace_id was never backfilled by the lifespan hook).
+    workspace_id = await _ensure_default_workspace(user)
+    token = create_access_token(
+        str(user.id),
+        token_version=user.token_version,
+        workspace_id=workspace_id,
+        role="owner",
+    )
     _set_session_cookie(response, token, request)
 
     return LoginResponse(
@@ -423,8 +431,17 @@ async def change_password(request: Request, response: Response, body: ChangePass
 
     await provider.update_user(user)
 
-    # Re-issue cookie with new token_version
-    token = create_access_token(str(user.id), token_version=user.token_version)
+    # Re-issue cookie with new token_version. wid + role must be carried
+    # forward so the re-signed JWT still passes the AuthMiddleware
+    # workspace gate; _ensure_default_workspace fills in for the (rare)
+    # case where the user predates PR4 and has not been backfilled.
+    workspace_id = await _ensure_default_workspace(user)
+    token = create_access_token(
+        str(user.id),
+        token_version=user.token_version,
+        workspace_id=workspace_id,
+        role="owner",
+    )
     _set_session_cookie(response, token, request)
 
     return MessageResponse(message="Password changed successfully")