feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/routes/sql.ts

@@ -0,0 +1,25 @@
+import type { FastifyInstance } from "fastify";
+import type { ThtRunner } from "../tht/tht-runner.js";
+
+export function sqlRoutes(app: FastifyInstance, deps: { tht: ThtRunner }): void {
+  app.post("/sessions/:id/sql/preview", async (req, reply) => {
+    const id = (req.params as any).id as string;
+    const { limit, offset } = (req.body as any) ?? {};
+    try {
+      const result = await deps.tht.sqlPreview(id, { limit, offset });
+      return result;
+    } catch (err: any) {
+      return reply.code(500).send({ error: err.message ?? String(err) });
+    }
+  });
+
+  app.post("/sessions/:id/sql/export", async (req, reply) => {
+    const id = (req.params as any).id as string;
+    try {
+      const result = await deps.tht.sqlExport(id);
+      return result;
+    } catch (err: any) {
+      return reply.code(500).send({ error: err.message ?? String(err) });
+    }
+  });
+}