fix: harden workspace registry deployment

backend/src/config.ts

@@ -23,6 +23,8 @@ export interface AppConfig {
    * pay the probe; the local dev launcher (run-stack.sh) opts in via THT_DWH_PRECHECK.
    */
   dwhPrecheck: boolean;
+  /** Explicit compatibility mode for old loopback clients that send `workspace` in POST /sessions. */
+  legacyWorkspaceMode: boolean;
   workspaceDiagnosticTimeoutMs: number;
   workspaceRegistry: WorkspaceRegistryConfig;
 }
@@ -103,6 +105,13 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
   if (sessionStorageMode === "local" && env.THOTH_PUBLIC_EXPOSURE === "true") {
     throw new Error("local session storage requires loopback-only deployment");
   }
+  const legacyWorkspaceMode = env.THT_LEGACY_WORKSPACE_MODE;
+  if (legacyWorkspaceMode !== undefined && legacyWorkspaceMode !== "local") {
+    throw new Error("legacy workspace mode configuration is invalid");
+  }
+  if (legacyWorkspaceMode === "local" && sessionStorageMode !== "local") {
+    throw new Error("legacy workspace mode requires local session storage");
+  }
   const sessionStorage: AppConfig["sessionStorage"] = { mode: sessionStorageMode };
   if (sessionStorageMode === "postgres") {
     const host = env.THT_SESSION_DB_HOST;
@@ -203,6 +212,7 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     secretFiles,
     modelApiKeyFile,
     dwhPrecheck: env.THT_DWH_PRECHECK === "true" || env.THT_DWH_PRECHECK === "1",
+    legacyWorkspaceMode: legacyWorkspaceMode === "local",
     workspaceDiagnosticTimeoutMs: diagnosticTimeout(env.THT_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS),
     workspaceRegistry,
   };