feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harness/tests/test_sql_preview_json.py

@@ -107,6 +107,44 @@ def test_do_run_offset_zero_path_unchanged(monkeypatch):
     assert captured["limit"] == 2
 
 
+def test_preview_session_no_file_resolves_sql_final(monkeypatch, tmp_path, capsys):
+    """--session without a positional FILE resolves sql_final.sql via _session_sql_file."""
+    from types import SimpleNamespace
+
+    from tht.cli import sql_cmd
+
+    sql_file = tmp_path / "sql_final.sql"
+    sql_file.write_text("SELECT session_resolved")
+
+    # Patch _session_sql_file to return our tmp file (no real workspace/DB needed).
+    monkeypatch.setattr(sql_cmd, "_session_sql_file", lambda cfg, sid: sql_file)
+
+    captured_sql = {}
+
+    def fake_do_run(cfg, sql, *, limit, offset=0):
+        captured_sql["sql"] = sql
+        return SimpleNamespace(columns=["x"], rows=[[42]], execution_ms=1, truncated=False)
+
+    monkeypatch.setattr(sql_cmd, "do_run", fake_do_run)
+    monkeypatch.setattr(sql_cmd, "validate_or_exit", lambda *a, **k: SimpleNamespace(ast=None))
+    monkeypatch.setattr(sql_cmd, "require_action", lambda *a, **k: None)
+    monkeypatch.setattr(
+        sql_cmd,
+        "_load_config_or_exit",
+        lambda *a, **k: SimpleNamespace(execution=SimpleNamespace(max_preview_rows=100)),
+    )
+
+    # Call with file=None, session="abc123" — should NOT raise.
+    sql_cmd.preview_cmd(file=None, limit=None, offset=0, session="abc123", json_out=True, config=None)
+
+    out = capsys.readouterr().out.strip()
+    data = json.loads(out)
+    assert data["columns"] == ["x"]
+    assert data["rows"] == [[42]]
+    # Confirm the SQL came from the file, not a None read.
+    assert captured_sql["sql"] == "SELECT session_resolved"
+
+
 def test_preview_json_pure_stdout(monkeypatch, tmp_path, capsys):
     from types import SimpleNamespace
 

harness/tht/cli/sql_cmd.py

@@ -183,19 +183,33 @@ def explain_cmd(
 
 @sql_app.command("preview")
 def preview_cmd(
-    file: Path = typer.Argument(...),
+    file: Path = typer.Argument(None, help="File SQL da eseguire. Opzionale se --session è dato."),
     limit: int = typer.Option(None, "--limit", help="Default: execution.max_preview_rows."),
     offset: int = typer.Option(0, "--offset", help="Riga di partenza (0-based) per il paging."),
     session: str = typer.Option(None, "--session"),
     json_out: bool = typer.Option(False, "--json", help="Output JSON puro per il backend (sopprime tabella rich)."),
     config: Path = CONFIG_OPT,
 ) -> None:
-    """Esecuzione controllata con LIMIT iniettato; aggregati mostrati per interi."""
+    """Esecuzione controllata con LIMIT iniettato; aggregati mostrati per interi.
+
+    Se FILE è omesso e --session è fornito, il file viene risolto automaticamente
+    come <workspace>/sessions/<session>/sql_final.sql (tramite _session_sql_file).
+    """
     from tht.execute import ExecutionError
 
     cfg = _load_config_or_exit(config)
     require_action(cfg, "preview")
-    sql = _read_sql(file)
+    if file is None:
+        if session is None:
+            typer.secho(
+                "ERRORE: specificare FILE oppure --session.",
+                fg=typer.colors.RED, err=True,
+            )
+            raise typer.Exit(code=1)
+        resolved = _session_sql_file(cfg, session)
+        sql = resolved.read_text()
+    else:
+        sql = _read_sql(file)
     check = validate_or_exit(cfg, sql, session)
     effective_limit = limit if limit is not None else cfg.execution.max_preview_rows
     try: