fix: Home → /workspaces, workspace name from cookie, CRUD + CSRF

- Home button now links to /workspaces (universal workspace page)
- Sidebar workspace section shows active workspace name from cookie
- _sidebar_data reads flowdeck_workspace cookie for active_ws_name
- local-workspace APIs filter by workspace_id (not global)
- newPageInWorkspace() JS function added to sidebar
- CSRF exemption for /api/local-workspace routes

app/routers/board.py

@@ -144,6 +144,19 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     ws_name = user.get("login", "Bruno") if user else "Bruno"
     ws_key = f"{owner}/{repo}" if owner and repo else ws_name  # workspace = project context
+
+    # Active workspace name from cookie (for local workspace display)
+    from app.routers.dashboard import WORKSPACE_COOKIE
+    ws_cookie = request.cookies.get(WORKSPACE_COOKIE, "")
+    active_ws_name = "Workspace"
+    if ws_cookie:
+        try:
+            with get_conn() as conn:
+                ws = conn.execute("SELECT name FROM workspaces WHERE id=?", (int(ws_cookie),)).fetchone()
+                if ws:
+                    active_ws_name = ws["name"]
+        except (ValueError, Exception):
+            pass
     recent = []
     if owner and repo:
         view_map = {
@@ -215,6 +228,7 @@ def _sidebar_data(request: Request, owner: str = "", repo: str = "") -> dict:
         })
 
     return {"workspace_name": ws_name, "workspace_initial": ws_name[0].upper() if ws_name else "B",
+            "active_ws_name": active_ws_name,
             "current_page": repo or "Dashboard", "last_edited": "now",
             "recent_pages": recent, "private_pages": private_items,
             "favorite_pages": favorites, "shared_pages": shared_pages,