fix(conversations): allow workspace-token conversation listing

[AKAICH00]

Summary

• add an explicit workspace-token conversation query entrypoint
• preserve session membership checks for the existing shared query
• keep all results scoped to the workspace resolved from the developer token
• clarify the workspace-token middleware context comment

Security boundary

The public handler authenticates through workspaceTokenAuthAPI, which resolves the opaque developer token to context.workspace and supplies that server-derived workspace ID to listConversationsForAPI. The existing listConversations entrypoint remains fail-closed with assertCurrentUserCanAccessChatbot.

This mirrors the existing contacts API pattern: token callers opt into a clearly named API entrypoint while session-authenticated callers retain membership enforcement. The private query implementation remains workspace-scoped.

Verification

• pnpm exec vitest run __tests__/conversation-workspace-token-api.test.ts src/features/conversations/queries/__tests__/list-conversations.query.test.ts — 2 files, 6 tests passed
• pnpm --filter builder check-types — passed
• pnpm lint — passed

The regressions cover valid-token/no-session success, invalid-token rejection, token-derived workspace scoping, and retained membership enforcement for session callers.