feat(task-10): SQL routes + /workspaces + /models + fix sql preview path bug

Harness:
- preview_cmd FILE positional arg made optional; when omitted with --session,
  path is derived via _session_sql_file (mirrors export_cmd) — fixes the
  deferred Task-5 bug where the backend passed sessions/<id>/sql_final.sql
  relative to harnessDir, which broke for workspace-dependent paths.
- New pytest: test_preview_session_no_file_resolves_sql_final

Backend:
- ThtRunner.sqlPreview: drop positional file arg; use --session only
- New routes/sql.ts: POST /sessions/:id/sql/preview + /export
- New routes/meta.ts: GET /workspaces (yaml scan) + GET /models (injectable
  seam + graceful fallback to {models:[]})
- app.ts: register sqlRoutes + metaRoutes; add listModels to BuildAppDeps
- tht-runner.test.ts: add sqlPreview argv assertion (no file path)
- test/routes-sql-meta.test.ts: 9 tests (sql preview/export + meta routes)

Tests: harness 233 passed; backend 29 passed; build clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

harness/tht/cli/sql_cmd.py

@@ -183,19 +183,33 @@ def explain_cmd(
 
 @sql_app.command("preview")
 def preview_cmd(
-    file: Path = typer.Argument(...),
+    file: Path = typer.Argument(None, help="File SQL da eseguire. Opzionale se --session è dato."),
     limit: int = typer.Option(None, "--limit", help="Default: execution.max_preview_rows."),
     offset: int = typer.Option(0, "--offset", help="Riga di partenza (0-based) per il paging."),
     session: str = typer.Option(None, "--session"),
     json_out: bool = typer.Option(False, "--json", help="Output JSON puro per il backend (sopprime tabella rich)."),
     config: Path = CONFIG_OPT,
 ) -> None:
-    """Esecuzione controllata con LIMIT iniettato; aggregati mostrati per interi."""
+    """Esecuzione controllata con LIMIT iniettato; aggregati mostrati per interi.
+
+    Se FILE è omesso e --session è fornito, il file viene risolto automaticamente
+    come <workspace>/sessions/<session>/sql_final.sql (tramite _session_sql_file).
+    """
     from tht.execute import ExecutionError
 
     cfg = _load_config_or_exit(config)
     require_action(cfg, "preview")
-    sql = _read_sql(file)
+    if file is None:
+        if session is None:
+            typer.secho(
+                "ERRORE: specificare FILE oppure --session.",
+                fg=typer.colors.RED, err=True,
+            )
+            raise typer.Exit(code=1)
+        resolved = _session_sql_file(cfg, session)
+        sql = resolved.read_text()
+    else:
+        sql = _read_sql(file)
     check = validate_or_exit(cfg, sql, session)
     effective_limit = limit if limit is not None else cfg.execution.max_preview_rows
     try: