feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/tht/tht-runner.ts

@@ -82,7 +82,9 @@ export class ThtRunner {
   }
 
   sqlPreview(id: string, p: { limit?: number; offset?: number }) {
-    const a = ["sql", "preview", `sessions/${id}/sql_final.sql`, "--session", id, "--json"];
+    // No positional FILE: the harness resolves sql_final.sql from the session
+    // via _session_sql_file(cfg, session_id), which respects the workspace path.
+    const a = ["sql", "preview", "--session", id, "--json"];
     if (p.limit != null) a.push("--limit", String(p.limit));
     if (p.offset != null) a.push("--offset", String(p.offset));
     return this.json<{