Multi-tenant workspaces

Every K-Agent user now gets a completely isolated workspace — their own files, projects, and terminal environment — powered by Firebase authentication and per-UID folder isolation on the backend.

Architecture

User workspaces live at `/workspace/<firebase-uid>/<project>/` on the server. The backend resolves the authenticated user's UID from their Firebase ID token and automatically creates the workspace on first login.

Each workspace contains:

`src/` — RTL source files

`tb/` — testbenches

`constraints/` — SDC timing constraints

`pdk/libs/` — PDK liberty files (sky130 bundled automatically)

`build/` — simulation VCDs, netlists, synthesis reports

Terminal sandboxing

The integrated terminal sandbox uses path clamping — any `cd` command that would escape the user's base directory is redirected back to their workspace root. Users cannot access other users' files.

Multi-project support

Users can create, switch, and delete projects from the Explorer panel. The active project is tracked per-session and all API calls are automatically scoped to it.