feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/meta.ts

@@ -0,0 +1,59 @@
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+import type { FastifyInstance } from "fastify";
+
+export type ListModelsFn = () => Promise<string[]>;
+
+/**
+ * List YAML workspace configs found in <harnessDir>/workspaces/*.yaml.
+ * Returns [{name, file}] — no database credentials or secrets.
+ */
+function listWorkspaces(harnessDir: string): { name: string; file: string }[] {
+  const dir = join(harnessDir, "workspaces");
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"))
+    .map((f) => ({
+      name: f.replace(/\.ya?ml$/, ""),
+      file: f,
+    }));
+}
+
+export function metaRoutes(
+  app: FastifyInstance,
+  deps: { harnessDir: string; listModels?: ListModelsFn },
+): void {
+  app.get("/workspaces", async () => {
+    return listWorkspaces(deps.harnessDir);
+  });
+
+  app.get("/models", async (_req, reply) => {
+    const fn = deps.listModels ?? defaultListModels;
+    try {
+      const models = await fn();
+      return { models };
+    } catch {
+      // Graceful fallback: Pi may not be running; don't crash the server.
+      return { models: [] };
+    }
+  });
+}
+
+/**
+ * Default implementation: spawns a short-lived `tht` invocation that asks a Pi
+ * process for available models via get_available_models.  This is intentionally
+ * behind the injectable seam so tests can stub it without spawning real processes.
+ *
+ * In the MVP we return an empty list — the real spawn path can be wired in later
+ * once a Pi-side "list models" RPC stabilises.
+ */
+async function defaultListModels(): Promise<string[]> {
+  // Real ephemeral Pi spawn left for a follow-up task.
+  // Returning [] here triggers the graceful fallback seen by clients.
+  return [];
+}

backend/src/routes/sql.ts

@@ -0,0 +1,25 @@
+import type { FastifyInstance } from "fastify";
+import type { ThtRunner } from "../tht/tht-runner.js";
+
+export function sqlRoutes(app: FastifyInstance, deps: { tht: ThtRunner }): void {
+  app.post("/sessions/:id/sql/preview", async (req, reply) => {
+    const id = (req.params as any).id as string;
+    const { limit, offset } = (req.body as any) ?? {};
+    try {
+      const result = await deps.tht.sqlPreview(id, { limit, offset });
+      return result;
+    } catch (err: any) {
+      return reply.code(500).send({ error: err.message ?? String(err) });
+    }
+  });
+
+  app.post("/sessions/:id/sql/export", async (req, reply) => {
+    const id = (req.params as any).id as string;
+    try {
+      const result = await deps.tht.sqlExport(id);
+      return result;
+    } catch (err: any) {
+      return reply.code(500).send({ error: err.message ?? String(err) });
+    }
+  });
+}