fix: /api/workspace/projects uses per-user Gitea token instead of global admin token

A local account without Gitea connection was seeing all Gitea repos
because the endpoint used the module-level gitea client (global admin token).
Now it checks get_user_gitea_client(request) and returns empty gitea_repos
if the user has no OAuth token for Gitea.

app/routers/dashboard.py

@@ -6,7 +6,7 @@ import logging
 from fastapi import APIRouter, Request, Query
 from fastapi.responses import HTMLResponse, RedirectResponse, JSONResponse
 
-from app.services.gitea_client import gitea
+from app.services.gitea_client import gitea, get_user_gitea_client
 from app.auth.session import SessionManager
 from app.db import get_conn
 
@@ -473,7 +473,10 @@ async def gitea_workspace_page(request: Request):
 
 @router.get("/api/workspace/projects")
 async def list_workspace_projects(request: Request):
-    """List all projects: built-in + Gitea + GitHub."""
+    """List all projects: built-in + Gitea + GitHub.
+    Uses the user's own Gitea token if connected, not the global admin token."""
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    
     builtin = []
     with get_conn() as conn:
         rows = conn.execute(
@@ -484,8 +487,11 @@ async def list_workspace_projects(request: Request):
             builtin.append({"id": str(r["id"]), "name": r["title"] or "Untitled", "pageCount": count, "forge": "builtin"})
 
     gitea_repos = []
+    # Use per-user token if available, otherwise return empty
+    user_gitea = get_user_gitea_client(request) if user else None
+    if user_gitea:
         try:
-        repos = await gitea.get_user_repos(page=1, limit=50)
+            repos = await user_gitea.get_user_repos(page=1, limit=50)
             for repo in repos:
                 gitea_repos.append({
                     "id": str(repo.get("id", "")),