fix: Home → /workspaces, workspace name from cookie, CRUD + CSRF

- Home button now links to /workspaces (universal workspace page)
- Sidebar workspace section shows active workspace name from cookie
- _sidebar_data reads flowdeck_workspace cookie for active_ws_name
- local-workspace APIs filter by workspace_id (not global)
- newPageInWorkspace() JS function added to sidebar
- CSRF exemption for /api/local-workspace routes

app/templates/base.html

@@ -62,7 +62,7 @@
 
     <!-- Navigation icons row -->
     <div class="sidebar-nav-row">
-      <a href="/" class="nav-icon-btn home-btn" :class="{ active: currentView === 'home' }" title="Home">
+      <a href="/workspaces" class="nav-icon-btn home-btn" :class="{ active: currentView === 'home' }" title="Home">
         <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 9l9-7 9 7v11a2 2 0 01-2 2H5a2 2 0 01-2-2z"/></svg>
         Home
       </a>
@@ -85,7 +85,7 @@
       <div class="sidebar-section-header" @click="toggleSection('workspace')">
         <div class="sidebar-section-title">
           <span class="chevron" :class="{ open: sectionsOpen.workspace }" x-text="sectionsOpen.workspace ? '▼' : '▶'"></span>
-          <span>📁 {{ workspace_name or 'Workspace' }}</span>
+          <span>📁 {{ active_ws_name or 'Workspace' }}</span>
         </div>
         <div class="sidebar-section-actions">
           <button class="section-action-btn" title="New Page" @click.stop="newPageInWorkspace()">+</button>
@@ -625,6 +625,18 @@
           .then(data => { window.location.href = `/pages/${data.id}`; })
           .catch(err => { alert('Failed to create sub-page: ' + err.message); });
       },
+      newPageInWorkspace() {
+        const name = prompt('Page name:');
+        if (!name || !name.trim()) return;
+        fetch('/api/local-workspace/items', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': this.getCsrfToken() },
+          body: JSON.stringify({ name: name.trim(), type: 'page' })
+        })
+          .then(r => { if (!r.ok) throw new Error('Failed'); return r.json(); })
+          .then(data => { window.location.href = `/pages/${data.id}`; })
+          .catch(err => { alert('Failed: ' + err.message); });
+      },
 
       createEmptyPage() {
         this.showNewPageMenu = false;