feat(persistence): PR6 T5.11 — ORM workspace_id nullable=False

Flip the 4 business ORM models (ThreadMetaRow, RunRow, FeedbackRow,
RunEventRow) to ``workspace_id: Mapped[str]`` with ``nullable=False``.
PR5's alembic 0003 already enforces NOT NULL at the DB layer; this
aligns the ORM-driven ``create_all()`` path (dev / tests) with the same
invariant so a new install ends up at the post-0003 schema without
running alembic.

Test fallout absorbed:

- `tests/conftest.py` autouse seed now produces a fully consistent
  pair: user row (default_workspace_id = test-workspace-autouse) plus
  the workspace itself. The PR5 backfill script's "users without
  default_workspace_id" query no longer picks the fixture up. Insert
  order is user → workspace → UPDATE user, walking around the chicken-
  and-egg FK between `workspaces.owner_id` and `users.default_workspace_id`.
- `tests/test_backfill_workspace_id.py` adds a file-scoped autouse
  fixture that temporarily flips `column.nullable = True` for the four
  business tables (production correctness comes from alembic 0003;
  the script's own job is exactly to fill rows between 0002 and 0003
  so its tests need that transient state to be representable). Its
  `_init_engine` also deletes the autouse seed rows to match the
  "fresh DB" model the tests assume.
- `test_thread_meta_workspace_filter::test_create_workspace_none_bypasses`
  renamed to `test_create_workspace_none_rejected_by_orm` and asserts
  the new IntegrityError on explicit None — write paths can no longer
  bypass workspace scope.
- 5 `test_workspace_context` tests + the auth-middleware reset test
  get `@pytest.mark.no_auto_workspace` so they keep testing the
  unset-contextvar path.
- `test_workspace_repo::test_list_by_user_bypass_returns_all` switches
  to membership assertions instead of strict equality since the
  autouse fixture surfaces under `user_id=None`.

3214 passed, 30 skipped; the remaining 17 are the documented
pre-existing caplog ordering flakes (all pass in isolation).

backend/tests/test_backfill_workspace_id.py

@@ -40,12 +40,51 @@ def anyio_backend() -> str:
     return "asyncio"
 
 
+_BUSINESS_ROWS = (ThreadMetaRow, RunRow, FeedbackRow, RunEventRow)
+
+
+@pytest.fixture(autouse=True)
+def _relax_workspace_id_nullable():
+    """Simulate alembic 0002 (pre-backfill) state during these tests.
+
+    PR6 T5.11 flipped ``workspace_id`` to ``nullable=False`` on the four
+    business ORM models — production correctness comes from alembic 0003.
+    The backfill script's job is precisely to fill the rows that were
+    inserted between 0002 (column added, nullable) and 0003 (NOT NULL),
+    so tests for it must be able to insert NULL rows. We mutate
+    ``column.nullable`` for the four tables before ``create_all`` runs,
+    then restore on teardown so other tests see the production shape.
+    """
+    saved: list[tuple] = []
+    for model in _BUSINESS_ROWS:
+        col = model.__table__.c.workspace_id
+        saved.append((col, col.nullable))
+        col.nullable = True
+    try:
+        yield
+    finally:
+        for col, original in saved:
+            col.nullable = original
+
+
 async def _init_engine(tmp_path):
+    from sqlalchemy import delete
+
     from deerflow.persistence.engine import get_session_factory, init_engine
 
     url = f"sqlite+aiosqlite:///{tmp_path / 'test.db'}"
     await init_engine("sqlite", url=url, sqlite_dir=str(tmp_path))
-    return get_session_factory()
+    sf = get_session_factory()
+    # The PR6 conftest seeds an autouse user + workspace so business-row FKs
+    # resolve in the wider test suite. Backfill tests model "fresh DB needs
+    # backfill" semantics, so wipe those rows here. Order: clear the FK
+    # pointer first, then the rows.
+    async with sf() as session:
+        await session.execute(delete(WorkspaceMembershipRow))
+        await session.execute(delete(WorkspaceRow).where(WorkspaceRow.id == "test-workspace-autouse"))
+        await session.execute(delete(UserRow).where(UserRow.id == "test-user-autouse"))
+        await session.commit()
+    return sf
 
 
 async def _close():