feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harness/tests/test_sql_preview_json.py

@@ -107,6 +107,44 @@ def test_do_run_offset_zero_path_unchanged(monkeypatch):
     assert captured["limit"] == 2
 
 
+def test_preview_session_no_file_resolves_sql_final(monkeypatch, tmp_path, capsys):
+    """--session without a positional FILE resolves sql_final.sql via _session_sql_file."""
+    from types import SimpleNamespace
+
+    from tht.cli import sql_cmd
+
+    sql_file = tmp_path / "sql_final.sql"
+    sql_file.write_text("SELECT session_resolved")
+
+    # Patch _session_sql_file to return our tmp file (no real workspace/DB needed).
+    monkeypatch.setattr(sql_cmd, "_session_sql_file", lambda cfg, sid: sql_file)
+
+    captured_sql = {}
+
+    def fake_do_run(cfg, sql, *, limit, offset=0):
+        captured_sql["sql"] = sql
+        return SimpleNamespace(columns=["x"], rows=[[42]], execution_ms=1, truncated=False)
+
+    monkeypatch.setattr(sql_cmd, "do_run", fake_do_run)
+    monkeypatch.setattr(sql_cmd, "validate_or_exit", lambda *a, **k: SimpleNamespace(ast=None))
+    monkeypatch.setattr(sql_cmd, "require_action", lambda *a, **k: None)
+    monkeypatch.setattr(
+        sql_cmd,
+        "_load_config_or_exit",
+        lambda *a, **k: SimpleNamespace(execution=SimpleNamespace(max_preview_rows=100)),
+    )
+
+    # Call with file=None, session="abc123" — should NOT raise.
+    sql_cmd.preview_cmd(file=None, limit=None, offset=0, session="abc123", json_out=True, config=None)
+
+    out = capsys.readouterr().out.strip()
+    data = json.loads(out)
+    assert data["columns"] == ["x"]
+    assert data["rows"] == [[42]]
+    # Confirm the SQL came from the file, not a None read.
+    assert captured_sql["sql"] == "SELECT session_resolved"
+
+
 def test_preview_json_pure_stdout(monkeypatch, tmp_path, capsys):
     from types import SimpleNamespace