fix: Home → /workspaces, workspace name from cookie, CRUD + CSRF

- Home button now links to /workspaces (universal workspace page)
- Sidebar workspace section shows active workspace name from cookie
- _sidebar_data reads flowdeck_workspace cookie for active_ws_name
- local-workspace APIs filter by workspace_id (not global)
- newPageInWorkspace() JS function added to sidebar
- CSRF exemption for /api/local-workspace routes

app/routers/board.py

@@ -144,6 +144,19 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     ws_name = user.get("login", "Bruno") if user else "Bruno"
     ws_key = f"{owner}/{repo}" if owner and repo else ws_name  # workspace = project context
+
+    # Active workspace name from cookie (for local workspace display)
+    from app.routers.dashboard import WORKSPACE_COOKIE
+    ws_cookie = request.cookies.get(WORKSPACE_COOKIE, "")
+    active_ws_name = "Workspace"
+    if ws_cookie:
+        try:
+            with get_conn() as conn:
+                ws = conn.execute("SELECT name FROM workspaces WHERE id=?", (int(ws_cookie),)).fetchone()
+                if ws:
+                    active_ws_name = ws["name"]
+        except (ValueError, Exception):
+            pass
     recent = []
     if owner and repo:
         view_map = {
@@ -215,6 +228,7 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
         })
 
     return {"workspace_name": ws_name, "workspace_initial": ws_name[0].upper() if ws_name else "B",
+            "active_ws_name": active_ws_name,
             "current_page": repo or "Dashboard", "last_edited": "now",
             "recent_pages": recent, "private_pages": private_items,
             "favorite_pages": favorites, "shared_pages": shared_pages,

app/routers/dashboard.py

@@ -488,7 +488,7 @@ async def local_workspace_page(request: Request):
         ).fetchall()
     items = [{"id": r["id"], "name": r["title"] or "Untitled", "type": "page"} for r in rows]
 
-    ctx = {**sidebar, "user": user, "workspace_name": "My Workspace", "items": items}
+    ctx = {**sidebar, "user": user, "workspace_name": sidebar.get("active_ws_name", "My Workspace"), "items": items}
     template = env.get_template("local_workspace.html")
     return template.render(**ctx)
 
@@ -514,14 +514,17 @@ async def local_workspace_tree(request: Request):
 
 @router.post("/api/local-workspace/items")
 async def create_local_workspace_item(request: Request):
-    """Create a new file."""
+    """Create a new file in the active workspace."""
     import json
     body = await request.json()
     name = body.get("name", "Untitled").strip()
+    ws = _get_active_workspace(request)
+    ws_id = ws["id"] if ws else None
     with get_conn() as conn:
         cursor = conn.execute(
-            "INSERT INTO pages (workspace, title, content, content_format, parent_section) VALUES ('', ?, '', 'blocks', 'Private')",
-            (name,),
+            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section) "
+            "VALUES ('', ?, ?, '', 'blocks', 'Private')",
+            (ws_id, name),
         )
         conn.commit()
         pid = cursor.lastrowid