Workspace access

Sign in before creating workspaces or approving CLI logins.

PhantomClaw Cloud uses Clerk for browser auth, then issues workspace-scoped tokens to the private CLI through the `/device` approval flow.