fix: /api/workspace/projects uses per-user Gitea token instead of global admin token

A local account without Gitea connection was seeing all Gitea repos
because the endpoint used the module-level gitea client (global admin token).
Now it checks get_user_gitea_client(request) and returns empty gitea_repos
if the user has no OAuth token for Gitea.

app/routers/dashboard.py

@@ -6,7 +6,7 @@ import logging
 from fastapi import APIRouter, Request, Query
 from fastapi.responses import HTMLResponse, RedirectResponse, JSONResponse
 
-from app.services.gitea_client import gitea
+from app.services.gitea_client import gitea, get_user_gitea_client
 from app.auth.session import SessionManager
 from app.db import get_conn
 
@@ -473,7 +473,10 @@ async def gitea_workspace_page(request: Request):
 
 @router.get("/api/workspace/projects")
 async def list_workspace_projects(request: Request):
-    """List all projects: built-in + Gitea + GitHub."""
+    """List all projects: built-in + Gitea + GitHub.
+    Uses the user's own Gitea token if connected, not the global admin token."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    
     builtin = []
     with get_conn() as conn:
         rows = conn.execute(
@@ -484,20 +487,23 @@ async def list_workspace_projects(request: Request):
             builtin.append({"id": str(r["id"]), "name": r["title"] or "Untitled", "pageCount": count, "forge": "builtin"})
 
     gitea_repos = []
-    try:
-        repos = await gitea.get_user_repos(page=1, limit=50)
-        for repo in repos:
-            gitea_repos.append({
-                "id": str(repo.get("id", "")),
-                "name": repo.get("name", ""),
-                "full_name": repo.get("full_name", ""),
-                "description": repo.get("description", ""),
-                "html_url": repo.get("html_url", ""),
-                "language": repo.get("language", ""),
-                "forge": "gitea",
-            })
-    except Exception:
-        pass
+    # Use per-user token if available, otherwise return empty
+    user_gitea = get_user_gitea_client(request) if user else None
+    if user_gitea:
+        try:
+            repos = await user_gitea.get_user_repos(page=1, limit=50)
+            for repo in repos:
+                gitea_repos.append({
+                    "id": str(repo.get("id", "")),
+                    "name": repo.get("name", ""),
+                    "full_name": repo.get("full_name", ""),
+                    "description": repo.get("description", ""),
+                    "html_url": repo.get("html_url", ""),
+                    "language": repo.get("language", ""),
+                    "forge": "gitea",
+                })
+        except Exception:
+            pass
 
     return {"builtin": builtin, "gitea": gitea_repos, "github": []}