fix: Home → /workspaces, workspace name from cookie, CRUD + CSRF

- Home button now links to /workspaces (universal workspace page)
- Sidebar workspace section shows active workspace name from cookie
- _sidebar_data reads flowdeck_workspace cookie for active_ws_name
- local-workspace APIs filter by workspace_id (not global)
- newPageInWorkspace() JS function added to sidebar
- CSRF exemption for /api/local-workspace routes

app/routers/dashboard.py

@@ -488,7 +488,7 @@ async def local_workspace_page(request: Request):
         ).fetchall()
     items = [{"id": r["id"], "name": r["title"] or "Untitled", "type": "page"} for r in rows]
 
-    ctx = {**sidebar, "user": user, "workspace_name": "My Workspace", "items": items}
+    ctx = {**sidebar, "user": user, "workspace_name": sidebar.get("active_ws_name", "My Workspace"), "items": items}
     template = env.get_template("local_workspace.html")
     return template.render(**ctx)
 
@@ -514,14 +514,17 @@ async def local_workspace_tree(request: Request):
 
 @router.post("/api/local-workspace/items")
 async def create_local_workspace_item(request: Request):
-    """Create a new file."""
+    """Create a new file in the active workspace."""
     import json
     body = await request.json()
     name = body.get("name", "Untitled").strip()
+    ws = _get_active_workspace(request)
+    ws_id = ws["id"] if ws else None
     with get_conn() as conn:
         cursor = conn.execute(
-            "INSERT INTO pages (workspace, title, content, content_format, parent_section) VALUES ('', ?, '', 'blocks', 'Private')",
-            (name,),
+            "INSERT INTO pages (workspace, workspace_id, title, content, content_format, parent_section) "
+            "VALUES ('', ?, ?, '', 'blocks', 'Private')",
+            (ws_id, name),
         )
         conn.commit()
         pid = cursor.lastrowid